f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bde

Analysis

max time kernel
118s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe
Size

468KB
MD5

7e155071a528eff8e60ca2724ea9e590
SHA1

5206ccbad784a2a8ba1914328324c94cdadcfa51
SHA256

f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bde
SHA512

738906ecd9947dd1071043b93234828e099444fb0687c79d4a4a06db02bd823bc36fa25a3f78cb9e84d11fe7fa20786dd30f1c1c4c35143c024eeeba1a97d548
SSDEEP

3072:4belogxaIU57tbYZPzcfmbfD/n2DnsIH/QmyegVqAu5Hkri3uxulj:4b4oCc7tCP4fmbfra1gu5EW3ux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1012	Unicorn-55450.exe
2648	Unicorn-46810.exe
208	Unicorn-51257.exe
1392	Unicorn-6649.exe
2764	Unicorn-3312.exe
1552	Unicorn-6457.exe
3368	Unicorn-8495.exe
4616	Unicorn-50474.exe
2368	Unicorn-46945.exe
3768	Unicorn-1081.exe
3552	Unicorn-9249.exe
3036	Unicorn-9249.exe
1200	Unicorn-19647.exe
2812	Unicorn-14080.exe
2684	Unicorn-33681.exe
2168	Unicorn-53738.exe
636	Unicorn-34256.exe
3664	Unicorn-2721.exe
4556	Unicorn-35586.exe
4772	Unicorn-29455.exe
4640	Unicorn-57329.exe
4168	Unicorn-36162.exe
944	Unicorn-60474.exe
3548	Unicorn-59249.exe
1856	Unicorn-39648.exe
1608	Unicorn-53384.exe
4776	Unicorn-59514.exe
4024	Unicorn-59514.exe
1216	Unicorn-58752.exe
1860	Unicorn-47817.exe
3500	Unicorn-54802.exe
3584	Unicorn-51273.exe
4996	Unicorn-56722.exe
3720	Unicorn-1391.exe
3776	Unicorn-20904.exe
4372	Unicorn-37034.exe
4876	Unicorn-53370.exe
2716	Unicorn-832.exe
1516	Unicorn-52913.exe
4488	Unicorn-61922.exe
216	Unicorn-1216.exe
2480	Unicorn-45394.exe
4260	Unicorn-45394.exe
2616	Unicorn-61730.exe
3808	Unicorn-41376.exe
212	Unicorn-27640.exe
1776	Unicorn-22040.exe
236	Unicorn-14833.exe
2804	Unicorn-14833.exe
768	Unicorn-47314.exe
1452	Unicorn-47314.exe
228	Unicorn-52145.exe
3132	Unicorn-6473.exe
1428	Unicorn-16679.exe
1188	Unicorn-39457.exe
3212	Unicorn-38960.exe
2496	Unicorn-47890.exe
3832	Unicorn-44361.exe
4760	Unicorn-7049.exe
4368	Unicorn-60889.exe
1256	Unicorn-25423.exe
3856	Unicorn-8201.exe
4648	Unicorn-37152.exe
1948	Unicorn-49426.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2840	15692	WerFault.exe	788
17000	3992	WerFault.exe	882
1068	16224	WerFault.exe	774

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11249.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1432	dwm.exe
Token: SeChangeNotifyPrivilege	1432	dwm.exe
Token: 33	1432	dwm.exe
Token: SeIncBasePriorityPrivilege	1432	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
908	f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe
1012	Unicorn-55450.exe
2648	Unicorn-46810.exe
208	Unicorn-51257.exe
1392	Unicorn-6649.exe
1552	Unicorn-6457.exe
2764	Unicorn-3312.exe
3368	Unicorn-8495.exe
4616	Unicorn-50474.exe
2368	Unicorn-46945.exe
2812	Unicorn-14080.exe
3552	Unicorn-9249.exe
3036	Unicorn-9249.exe
3768	Unicorn-1081.exe
1200	Unicorn-19647.exe
2684	Unicorn-33681.exe
2168	Unicorn-53738.exe
636	Unicorn-34256.exe
3664	Unicorn-2721.exe
4556	Unicorn-35586.exe
4772	Unicorn-29455.exe
4640	Unicorn-57329.exe
4168	Unicorn-36162.exe
3548	Unicorn-59249.exe
944	Unicorn-60474.exe
1216	Unicorn-58752.exe
4024	Unicorn-59514.exe
4776	Unicorn-59514.exe
1860	Unicorn-47817.exe
1608	Unicorn-53384.exe
1856	Unicorn-39648.exe
3500	Unicorn-54802.exe
3584	Unicorn-51273.exe
4996	Unicorn-56722.exe
3720	Unicorn-1391.exe
3776	Unicorn-20904.exe
4372	Unicorn-37034.exe
4876	Unicorn-53370.exe
2716	Unicorn-832.exe
1516	Unicorn-52913.exe
4488	Unicorn-61922.exe
2480	Unicorn-45394.exe
2616	Unicorn-61730.exe
216	Unicorn-1216.exe
4260	Unicorn-45394.exe
3808	Unicorn-41376.exe
236	Unicorn-14833.exe
1776	Unicorn-22040.exe
768	Unicorn-47314.exe
1452	Unicorn-47314.exe
228	Unicorn-52145.exe
3132	Unicorn-6473.exe
3832	Unicorn-44361.exe
1428	Unicorn-16679.exe
1188	Unicorn-39457.exe
212	Unicorn-27640.exe
2804	Unicorn-14833.exe
3212	Unicorn-38960.exe
4368	Unicorn-60889.exe
4760	Unicorn-7049.exe
1256	Unicorn-25423.exe
2496	Unicorn-47890.exe
3856	Unicorn-8201.exe
3684	Unicorn-62233.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1012	908	f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe	86
PID 908 wrote to memory of 1012	908	f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe	86
PID 908 wrote to memory of 1012	908	f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe	86
PID 1012 wrote to memory of 2648	1012	Unicorn-55450.exe	87
PID 1012 wrote to memory of 2648	1012	Unicorn-55450.exe	87
PID 1012 wrote to memory of 2648	1012	Unicorn-55450.exe	87
PID 908 wrote to memory of 208	908	f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe	88
PID 908 wrote to memory of 208	908	f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe	88
PID 908 wrote to memory of 208	908	f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe	88
PID 2648 wrote to memory of 1392	2648	Unicorn-46810.exe	89
PID 2648 wrote to memory of 1392	2648	Unicorn-46810.exe	89
PID 2648 wrote to memory of 1392	2648	Unicorn-46810.exe	89
PID 1012 wrote to memory of 2764	1012	Unicorn-55450.exe	90
PID 1012 wrote to memory of 2764	1012	Unicorn-55450.exe	90
PID 1012 wrote to memory of 2764	1012	Unicorn-55450.exe	90
PID 208 wrote to memory of 1552	208	Unicorn-51257.exe	91
PID 208 wrote to memory of 1552	208	Unicorn-51257.exe	91
PID 208 wrote to memory of 1552	208	Unicorn-51257.exe	91
PID 908 wrote to memory of 3368	908	f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe	92
PID 908 wrote to memory of 3368	908	f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe	92
PID 908 wrote to memory of 3368	908	f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe	92
PID 1392 wrote to memory of 4616	1392	Unicorn-6649.exe	93
PID 1392 wrote to memory of 4616	1392	Unicorn-6649.exe	93
PID 1392 wrote to memory of 4616	1392	Unicorn-6649.exe	93
PID 2648 wrote to memory of 2368	2648	Unicorn-46810.exe	94
PID 2648 wrote to memory of 2368	2648	Unicorn-46810.exe	94
PID 2648 wrote to memory of 2368	2648	Unicorn-46810.exe	94
PID 2764 wrote to memory of 3768	2764	Unicorn-3312.exe	95
PID 2764 wrote to memory of 3768	2764	Unicorn-3312.exe	95
PID 2764 wrote to memory of 3768	2764	Unicorn-3312.exe	95
PID 1552 wrote to memory of 3552	1552	Unicorn-6457.exe	96
PID 1552 wrote to memory of 3552	1552	Unicorn-6457.exe	96
PID 1552 wrote to memory of 3552	1552	Unicorn-6457.exe	96
PID 3368 wrote to memory of 3036	3368	Unicorn-8495.exe	97
PID 3368 wrote to memory of 3036	3368	Unicorn-8495.exe	97
PID 3368 wrote to memory of 3036	3368	Unicorn-8495.exe	97
PID 1012 wrote to memory of 1200	1012	Unicorn-55450.exe	98
PID 1012 wrote to memory of 1200	1012	Unicorn-55450.exe	98
PID 1012 wrote to memory of 1200	1012	Unicorn-55450.exe	98
PID 208 wrote to memory of 2812	208	Unicorn-51257.exe	99
PID 208 wrote to memory of 2812	208	Unicorn-51257.exe	99
PID 208 wrote to memory of 2812	208	Unicorn-51257.exe	99
PID 908 wrote to memory of 2684	908	f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe	100
PID 908 wrote to memory of 2684	908	f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe	100
PID 908 wrote to memory of 2684	908	f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe	100
PID 4616 wrote to memory of 2168	4616	Unicorn-50474.exe	101
PID 4616 wrote to memory of 2168	4616	Unicorn-50474.exe	101
PID 4616 wrote to memory of 2168	4616	Unicorn-50474.exe	101
PID 1392 wrote to memory of 636	1392	Unicorn-6649.exe	102
PID 1392 wrote to memory of 636	1392	Unicorn-6649.exe	102
PID 1392 wrote to memory of 636	1392	Unicorn-6649.exe	102
PID 2368 wrote to memory of 3664	2368	Unicorn-46945.exe	103
PID 2368 wrote to memory of 3664	2368	Unicorn-46945.exe	103
PID 2368 wrote to memory of 3664	2368	Unicorn-46945.exe	103
PID 3768 wrote to memory of 4556	3768	Unicorn-1081.exe	104
PID 3768 wrote to memory of 4556	3768	Unicorn-1081.exe	104
PID 3768 wrote to memory of 4556	3768	Unicorn-1081.exe	104
PID 2648 wrote to memory of 4772	2648	Unicorn-46810.exe	105
PID 2648 wrote to memory of 4772	2648	Unicorn-46810.exe	105
PID 2648 wrote to memory of 4772	2648	Unicorn-46810.exe	105
PID 2764 wrote to memory of 4640	2764	Unicorn-3312.exe	106
PID 2764 wrote to memory of 4640	2764	Unicorn-3312.exe	106
PID 2764 wrote to memory of 4640	2764	Unicorn-3312.exe	106
PID 2812 wrote to memory of 4168	2812	Unicorn-14080.exe	107

C:\Users\Admin\AppData\Local\Temp\f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe
"C:\Users\Admin\AppData\Local\Temp\f9af75dad0f2f0e631e40b872cb3d1545941fbafe912b9796a4da3ea24454bdeN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46810.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8201.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        9⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        10⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45728.exe
        9⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
        9⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        9⤵
        
        PID:17184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        9⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        8⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36762.exe
        9⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38138.exe
        10⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12712.exe
        10⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        10⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58713.exe
        9⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        9⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        9⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
        9⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        8⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14540.exe
        8⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37152.exe
        7⤵
        Executes dropped EXE
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
        8⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24858.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36824.exe
        9⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
        9⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        9⤵
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        8⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        8⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9532.exe
        8⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
        8⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16272.exe
        8⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        7⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
        7⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
        7⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35054.exe
        7⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51273.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49426.exe
        7⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46394.exe
        9⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        9⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        9⤵
        
        PID:16792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        8⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50180.exe
        8⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39186.exe
        8⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39816.exe
        8⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15861.exe
        8⤵
        
        PID:17184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61864.exe
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19865.exe
        7⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        7⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34935.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28098.exe
        7⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        8⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64209.exe
        8⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51401.exe
        7⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58040.exe
        7⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        7⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        7⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63793.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21799.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        7⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43832.exe
        7⤵
        
        PID:16916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        7⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        6⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58338.exe
        7⤵
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6349.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24177.exe
        6⤵
        
        PID:14004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34256.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56722.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
        7⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63394.exe
        9⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        9⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        9⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
        8⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        8⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5904.exe
        8⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26098.exe
        8⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1929.exe
        9⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        9⤵
        
        PID:16776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
        8⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25103.exe
        8⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe
        8⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53128.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33272.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
        7⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34154.exe
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
        8⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        9⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        9⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        9⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        8⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        8⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
        8⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33812.exe
        8⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6055.exe
        7⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4352.exe
        7⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exe
        7⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48314.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43464.exe
        7⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16437.exe
        7⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
        6⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59761.exe
        6⤵
        
        PID:11864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
        6⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14867.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
        6⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62418.exe
        8⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2761.exe
        9⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        9⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50776.exe
        9⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48534.exe
        9⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24416.exe
        8⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        8⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59713.exe
        8⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        8⤵
        
        PID:16616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
        8⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51401.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59481.exe
        7⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
        7⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 68
        8⤵
        Program crash
        
        PID:17000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        7⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        8⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        8⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
        8⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        7⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
        7⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe
        7⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32039.exe
        7⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        6⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55449.exe
        6⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
        6⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57137.exe
        5⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        7⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        7⤵
        
        PID:16876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32039.exe
        7⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
        6⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
        6⤵
        
        PID:676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        6⤵
        
        PID:16884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46274.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34602.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24416.exe
        6⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        6⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
        6⤵
        
        PID:11296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21104.exe
        5⤵
        
        PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30978.exe
        5⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
        5⤵
        
        PID:14872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48326.exe
        5⤵
        
        PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2721.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        7⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        9⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1814.exe
        10⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3112.exe
        9⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
        9⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23369.exe
        8⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
        8⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48496.exe
        7⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        8⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43464.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24414.exe
        8⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
        7⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        7⤵
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        7⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20728.exe
        6⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42922.exe
        8⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57778.exe
        9⤵
        
        PID:16808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63480.exe
        9⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        8⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        8⤵
        
        PID:16824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exe
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        7⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        7⤵
        
        PID:16292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41205.exe
        7⤵
        
        PID:15912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61353.exe
        7⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        6⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        7⤵
        
        PID:17272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        6⤵
        
        PID:12952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31791.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23663.exe
        6⤵
        
        PID:10304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-832.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        6⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36570.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe
        9⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        9⤵
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3496.exe
        9⤵
        
        PID:16928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
        9⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5480.exe
        8⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13559.exe
        8⤵
        
        PID:10776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        8⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55629.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41888.exe
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33439.exe
        7⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        7⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        7⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46681.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3352.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        8⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45493.exe
        8⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        7⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        7⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22951.exe
        6⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        7⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50646.exe
        7⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14800.exe
        6⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe
        6⤵
        
        PID:14824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15894.exe
        6⤵
        
        PID:17176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35232.exe
        5⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        6⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43505.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        6⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57792.exe
        6⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53289.exe
        6⤵
        
        PID:16892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        6⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35719.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33336.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe
        5⤵
        
        PID:15632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29455.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        6⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46114.exe
        8⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        8⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
        8⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        7⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63990.exe
        7⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
        7⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        6⤵
        
        PID:16336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
        6⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62721.exe
        5⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        6⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        7⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64757.exe
        7⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
        6⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52672.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exe
        6⤵
        
        PID:15692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15692 -s 464
        7⤵
        Program crash
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
        6⤵
        
        PID:17356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13143.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2481.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
        6⤵
        
        PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        5⤵
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31791.exe
        5⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        5⤵
        
        PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52913.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        5⤵
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35690.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
        7⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56352.exe
        7⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33463.exe
        7⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exe
        6⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39506.exe
        7⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        7⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32313.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48496.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34712.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
        6⤵
        
        PID:17060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        5⤵
        
        PID:9044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59192.exe
        5⤵
        
        PID:12416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
        5⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31847.exe
        5⤵
        
        PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exe
      4⤵
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
        6⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30488.exe
        6⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53080.exe
        6⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        6⤵
        
        PID:16768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35673.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
        5⤵
        
        PID:16896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
      4⤵
      PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36421.exe
        5⤵
        
        PID:8016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29914.exe
      4⤵
      PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44351.exe
      4⤵
      PID:12920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39704.exe
      4⤵
      PID:16428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3312.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1081.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61922.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exe
        7⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42736.exe
        8⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
        9⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        9⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        9⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
        9⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        8⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
        8⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47976.exe
        8⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        8⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32072.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58770.exe
        8⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        8⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe
        8⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
        7⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62776.exe
        7⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20404.exe
        7⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63105.exe
        6⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
        8⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        7⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36164.exe
        7⤵
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        6⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28359.exe
        6⤵
        
        PID:13636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        6⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55586.exe
        6⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42736.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        8⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
        7⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        7⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62728.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe
        7⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61353.exe
        7⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        7⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        6⤵
        
        PID:12968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49504.exe
        6⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56159.exe
        6⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36960.exe
        5⤵
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        7⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-0.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-0.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
        6⤵
        
        PID:12884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
        6⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        6⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
        5⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1929.exe
        6⤵
        
        PID:15772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58029.exe
        5⤵
        
        PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45394.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
        6⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50786.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34874.exe
        8⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        8⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32952.exe
        7⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52672.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24545.exe
        7⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        7⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10640.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
        7⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16629.exe
        7⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22287.exe
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25009.exe
        6⤵
        
        PID:13028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8671.exe
        6⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
        6⤵
        
        PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        5⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        6⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61353.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        7⤵
        
        PID:8984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        6⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20404.exe
        6⤵
        
        PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
        5⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        5⤵
        
        PID:11124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35630.exe
        5⤵
        
        PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57890.exe
        5⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34450.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61282.exe
        7⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
        7⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7693.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        6⤵
        
        PID:16344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24677.exe
        6⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe
        6⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26079.exe
        6⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64294.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41345.exe
        5⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8671.exe
        5⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
        5⤵
        
        PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44553.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        6⤵
        
        PID:12524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        6⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
        5⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
        5⤵
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
        5⤵
        
        PID:7872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exe
      4⤵
      PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
        5⤵
        
        PID:14256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exe
        5⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        5⤵
        
        PID:10548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
      4⤵
      PID:10588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe
      4⤵
      PID:14964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47229.exe
      4⤵
      PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47890.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24450.exe
        6⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19186.exe
        8⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        8⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57792.exe
        8⤵
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18300.exe
        8⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3752.exe
        7⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
        7⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14120.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        6⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63681.exe
        5⤵
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        6⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        7⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        6⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20177.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37420.exe
        6⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13831.exe
        5⤵
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        5⤵
        
        PID:14944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        5⤵
        
        PID:16456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        5⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        6⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        7⤵
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64209.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
        6⤵
        
        PID:14672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25169.exe
        5⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14703.exe
        5⤵
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56609.exe
        5⤵
        
        PID:15388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
      4⤵
      PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11520.exe
        5⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6513.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50097.exe
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        6⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        5⤵
        
        PID:10664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        5⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11664.exe
        5⤵
        
        PID:9168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50529.exe
        5⤵
        
        PID:10260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63985.exe
      4⤵
      PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28546.exe
        5⤵
        
        PID:14636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
        5⤵
        
        PID:8968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46784.exe
      4⤵
      PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
      4⤵
      PID:14816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64184.exe
      4⤵
      PID:16252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47314.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65482.exe
        5⤵
        
        PID:384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2481.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2424.exe
        7⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
        7⤵
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        6⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        6⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        6⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
        6⤵
        
        PID:13580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
        6⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        5⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12015.exe
        5⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        5⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        5⤵
        
        PID:9156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24952.exe
      4⤵
      PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59969.exe
        5⤵
        
        PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
        5⤵
        
        PID:15408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26983.exe
      4⤵
      PID:7804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
      4⤵
      PID:10896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23647.exe
      4⤵
      PID:12988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
      4⤵
      PID:17244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
      4⤵
      PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38960.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51258.exe
      4⤵
      PID:232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36946.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        6⤵
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        6⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
        5⤵
        
        PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        5⤵
        
        PID:13508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
        5⤵
        
        PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
      4⤵
      PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe
        5⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        5⤵
        
        PID:11576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2343.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        5⤵
        
        PID:16404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
        5⤵
        
        PID:17312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24015.exe
      4⤵
      PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exe
      4⤵
      PID:13000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24815.exe
      4⤵
      PID:16512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
      4⤵
      PID:6648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
    3⤵
    PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6393.exe
      4⤵
      PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61602.exe
        5⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1445.exe
        5⤵
        
        PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
      4⤵
      PID:9704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
      4⤵
      PID:11704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe
      4⤵
      PID:17084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41743.exe
      4⤵
      PID:2832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55850.exe
    3⤵
    PID:7396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47394.exe
      4⤵
      PID:15780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
    3⤵
    PID:10624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53144.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56442.exe
        6⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12145.exe
        7⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        8⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47354.exe
        9⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25592.exe
        9⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
        9⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe
        9⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        8⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2615.exe
        8⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
        8⤵
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        8⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8167.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58271.exe
        7⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38512.exe
        6⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        7⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
        7⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
        7⤵
        
        PID:17012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17284.exe
        7⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        6⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63498.exe
        7⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        8⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17424.exe
        7⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
        7⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55449.exe
        6⤵
        
        PID:10680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
        6⤵
        
        PID:15056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        6⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        5⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44818.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
        7⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24194.exe
        8⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        8⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        8⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
        7⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
        7⤵
        
        PID:17032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
        7⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44385.exe
        6⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        7⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exe
        7⤵
        
        PID:16996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        7⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        6⤵
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
        6⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49753.exe
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        7⤵
        
        PID:15560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4535.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe
        6⤵
        
        PID:16640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33620.exe
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        5⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
        5⤵
        
        PID:9600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52242.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33493.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39648.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7049.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40594.exe
        6⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59746.exe
        8⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26079.exe
        8⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1637.exe
        8⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        7⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        7⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17988.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        6⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62666.exe
        7⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        7⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        6⤵
        
        PID:11376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        6⤵
        
        PID:13912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe
        6⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55513.exe
        5⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3121.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        7⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
        7⤵
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        6⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        6⤵
        
        PID:9476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15850.exe
        6⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        6⤵
        
        PID:16056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28729.exe
        5⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        5⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe
        6⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63057.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39.exe
        6⤵
        
        PID:16324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61457.exe
        6⤵
        
        PID:17312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12131.exe
        6⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        5⤵
        
        PID:13104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
        5⤵
        
        PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
      4⤵
      PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36570.exe
        5⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe
        6⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48342.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
        5⤵
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        5⤵
        
        PID:13120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe
        5⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
        5⤵
        
        PID:652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
      4⤵
      PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62921.exe
      4⤵
      PID:9756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
      4⤵
      PID:14004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
      4⤵
      PID:14880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45394.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        6⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16386.exe
        7⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54546.exe
        8⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        9⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        9⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        8⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
        8⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13248.exe
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64488.exe
        7⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32313.exe
        7⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exe
        7⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23904.exe
        6⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exe
        7⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exe
        7⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe
        7⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48001.exe
        7⤵
        
        PID:17036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
        7⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
        6⤵
        
        PID:15684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17604.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46961.exe
        5⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62218.exe
        6⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47354.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65062.exe
        7⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9128.exe
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        6⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26081.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6319.exe
        5⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34144.exe
        6⤵
        
        PID:14208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16245.exe
        6⤵
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        5⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        5⤵
        
        PID:12960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        5⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        5⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19845.exe
        5⤵
        
        PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27640.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9841.exe
        5⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54250.exe
        6⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7888.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
        6⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exe
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
        5⤵
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55360.exe
        5⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22800.exe
        5⤵
        
        PID:16744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
        5⤵
        
        PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42730.exe
        5⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43838.exe
        6⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        5⤵
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        5⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        5⤵
        
        PID:17324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
      4⤵
      PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
      4⤵
      PID:11980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46240.exe
      4⤵
      PID:16308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
      4⤵
      PID:10312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47314.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41736.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
        6⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        5⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        5⤵
        
        PID:13092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3007.exe
        5⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59981.exe
        5⤵
        
        PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42848.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
      4⤵
      PID:11624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
      4⤵
      PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
      4⤵
      PID:9908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39457.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
      4⤵
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25640.exe
        5⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        6⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
        6⤵
        
        PID:17096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-869.exe
        6⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        5⤵
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52116.exe
        5⤵
        
        PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64945.exe
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
        5⤵
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13735.exe
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
      4⤵
      PID:12868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51540.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
    3⤵
    PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50457.exe
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
      4⤵
      PID:14200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
      4⤵
      PID:1252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7648.exe
    3⤵
    PID:7812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62218.exe
    3⤵
    PID:10880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
    3⤵
    PID:12840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
    3⤵
    PID:16480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16614.exe
    3⤵
    PID:7280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
        6⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
        8⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64041.exe
        8⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
        7⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21063.exe
        7⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        7⤵
        
        PID:16980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
        7⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33191.exe
        7⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58136.exe
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        6⤵
        
        PID:14860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23909.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        5⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15488.exe
        5⤵
        
        PID:16236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        5⤵
        
        PID:7376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44361.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
        6⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        7⤵
        
        PID:16564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1280.exe
        6⤵
        
        PID:15652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41405.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        5⤵
        
        PID:11584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43832.exe
        5⤵
        
        PID:16904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        5⤵
        
        PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21583.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        5⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44498.exe
        6⤵
        
        PID:14436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3280.exe
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9343.exe
        5⤵
        
        PID:15048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17104.exe
      4⤵
      PID:11856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
      4⤵
      PID:16948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exe
      4⤵
      PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe
      4⤵
      PID:8284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8713.exe
        6⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12128.exe
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23293.exe
        6⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45728.exe
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
        5⤵
        
        PID:10956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46824.exe
        5⤵
        
        PID:15708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        5⤵
        
        PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
      4⤵
      PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1209.exe
        5⤵
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33840.exe
        5⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25103.exe
        5⤵
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24222.exe
        5⤵
        
        PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42848.exe
      4⤵
      PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
      4⤵
      PID:11692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
      4⤵
      PID:16224
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16224 -s 468
        5⤵
        Program crash
        
        PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18180.exe
      4⤵
      PID:6712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
      4⤵
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62418.exe
        5⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55906.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        6⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        6⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7888.exe
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
        5⤵
        
        PID:13044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9646.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe
      4⤵
      PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
      4⤵
      PID:10656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
      4⤵
      PID:14912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
      4⤵
      PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
      4⤵
      PID:7728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43593.exe
    3⤵
    PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
      4⤵
      PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        5⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
        5⤵
        
        PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19704.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57584.exe
      4⤵
      PID:14764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47261.exe
      4⤵
      PID:3968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65505.exe
    3⤵
    PID:8164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
    3⤵
    PID:11960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52143.exe
    3⤵
    PID:15400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
    3⤵
    PID:4592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
        5⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27266.exe
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29807.exe
        7⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        7⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        6⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
        5⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        6⤵
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
        5⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exe
        5⤵
        
        PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
        5⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24952.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54250.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
        6⤵
        
        PID:17196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31700.exe
        6⤵
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49113.exe
        5⤵
        
        PID:9916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
        5⤵
        
        PID:14300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        5⤵
        
        PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
      4⤵
      PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39113.exe
      4⤵
      PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
      4⤵
      PID:14928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61821.exe
      4⤵
      PID:7236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52145.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        5⤵
        
        PID:12836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42136.exe
        5⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
        5⤵
        
        PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45728.exe
      4⤵
      PID:8620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
      4⤵
      PID:10728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
      4⤵
      PID:15636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
      4⤵
      PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
    3⤵
    PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
      4⤵
      PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9256.exe
      4⤵
      PID:14056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
      4⤵
      PID:1956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
    3⤵
    PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
      4⤵
      PID:16256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27538.exe
    3⤵
    PID:13432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61730.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55586.exe
      4⤵
      PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50210.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39408.exe
        6⤵
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        6⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe
        6⤵
        
        PID:17348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        5⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31537.exe
        5⤵
        
        PID:11936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8951.exe
        5⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe
        5⤵
        
        PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53889.exe
      4⤵
      PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe
        5⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        5⤵
        
        PID:16816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
        5⤵
        
        PID:17388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
      4⤵
      PID:8232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
      4⤵
      PID:11564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43832.exe
      4⤵
      PID:16940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
      4⤵
      PID:16444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24568.exe
    3⤵
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
      4⤵
      PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34144.exe
        5⤵
        
        PID:14268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
        5⤵
        
        PID:112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
      4⤵
      PID:9468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21063.exe
      4⤵
      PID:13288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51545.exe
      4⤵
      PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
      4⤵
      PID:2860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14783.exe
    3⤵
    PID:7304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25361.exe
    3⤵
    PID:8256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59834.exe
    3⤵
    PID:13468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52517.exe
    3⤵
    PID:16848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22040.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22040.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
    3⤵
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45114.exe
      4⤵
      PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9079.exe
        5⤵
        
        PID:16940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exe
      4⤵
      PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44609.exe
      4⤵
      PID:13316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54555.exe
      4⤵
      PID:10036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
    3⤵
    PID:8068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14504.exe
    3⤵
    PID:12060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
    3⤵
    PID:15592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18484.exe
    3⤵
    PID:5920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
  2⤵
  PID:5288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
      4⤵
      PID:11776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
      4⤵
      PID:2064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
    3⤵
    PID:9740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
    3⤵
    PID:11744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
    3⤵
    PID:17024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33600.exe
    3⤵
    PID:17240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45336.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45336.exe
  2⤵
  PID:10508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32648.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32648.exe
  2⤵
  PID:14772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28998.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28998.exe
  2⤵
  PID:16508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 16316 -ip 16316
1⤵
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 16224 -ip 16224
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 15692 -ip 15692
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3992 -ip 3992
1⤵
PID:5064

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1081.exe

Filesize
468KB

MD5
306b91900c5e076790153561271e387f

SHA1
56ef2d0c5349c58911fb7f5c5d4a3ed02114adcd

SHA256
c4474faeec52e7af72e9fd11b2a32c2f0f66c92342ea302f267509ecb1d38522

SHA512
616a9687f11e890fd6a5ecf87241ad27576672edf460155237f9627422117b422f20b56bf5846f02cc72f2080e428d20ca4ccb1e0c1cf8912611faab6192f274

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe

Filesize
468KB

MD5
eb3afe549fda573de81a089173b0f54f

SHA1
a31d272c784747a3ce99b40f248adc6f51d7fecb

SHA256
5af8d740b4b45d39778f0afd75c03c96f06d6f81490ce6a599a856596a195778

SHA512
e5629e8608268bc558fbf46f4c47f23505f12c0d55defe2cc80d7bcd8b6c0ebd86e88bbf2f258c711235f0457415685f348da33d2fa0f20c36b4813a2a74bdb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14312.exe

Filesize
1B

MD5
93b885adfe0da089cdf634904fd59f71

SHA1
5ba93c9db0cff93f52b521d7420e43f6eda2784f

SHA256
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

SHA512
b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe

Filesize
468KB

MD5
4f6d8ffe7154c0c0bab85149dba7c183

SHA1
9f21cf33a953ad790189434f9bf966fbbd082219

SHA256
d276ea4d16c1e809d780ed874492a753c3354e089496725c2df9f095b2812937

SHA512
7a54282350d5152554a407093b198e615b364e279fc74f653e74582ec5cd6b414b36234ebf076da81a7bee7b78c4834c59bde404f8a9c21ba4c973c0a0a695b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2721.exe

Filesize
468KB

MD5
9f20b7a52aefcf394516a836d9519f59

SHA1
3838ab56beecbacb54d185bd5cb6fa9ccfa17e00

SHA256
a9e0b46413d66c09f146df65823d12c89327a4a4a90526dcb353ef626a72535d

SHA512
979742793345e03e9c7cd2d1d8bc8d1cf56cd73ccbc70280d91a85ad5e0c42b22a55d0676e7dd7784302d95a9f9f9f537333e9dbcc9bb9eab863d2b9fac12981

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29455.exe

Filesize
468KB

MD5
c74e0b49b7b28425d57c8ee4a5bd14c2

SHA1
fec4d83bbc528564dc92daeab5ab8538806ea66c

SHA256
15f6c32a4451459e74f5e4d7642d0ca77fca05cc461673940f8b83bd4e8d3d89

SHA512
bedb9a77569e2c8c17548088d1f0977176bc1679a3ca30d7449735ab8cb735a109185718652b2d3e6beb8fc3e65162dd650014940bc4a6586db341169b6f2478

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3312.exe

Filesize
468KB

MD5
0b314a1dc8a1727fbe0fcf6b59fe626f

SHA1
7c50634a1917b1dc7e1b3d638dd7d5f3fb17df75

SHA256
36224df4cea8f369f2307a2c260ffa114c8900a57b96848cf41ef205cee07501

SHA512
d97ebc92eecb0565e88315c29112b0e56d0c58d1533a9768f56b5d901e7c9e442b85b527c6bbe9c24412b31a9688af5f0e6deb5e0eb7ea3e2c0613cbc359409d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe

Filesize
468KB

MD5
e03b9bcf72fd1e3e04a08afc8a9db8fa

SHA1
d4023d48fffed594399d50768b846afd3b5bc927

SHA256
08e108fd8f6502b1e64cb75488b8df09ef827ff65de1c9fff5cd9dab45bfb633

SHA512
74dfd5876fd73a928a3670d4373827bd6ae195344c06b4d946e6e1d60d7c53498cb5a21f4d90cd1451eef80884298145881a2fc6601c4d80b2987e0e86864c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34256.exe

Filesize
468KB

MD5
4e45e41636875986b750c11602690498

SHA1
392a4aca19fbbba5769ca33e7ce4556e85208ca6

SHA256
80ec83ba7083e68691a96ad8c68b79c228340753ab4b152ab44f58c9dbd45426

SHA512
eaa86b3f96804f5f2c1907f06bd94abae722096da433aa08f77878aa2ee57844fb7c36b3c8c2bbb4b3133e7d5f82fc9f58f31d76553a43a29b7e8f0f08d317d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe

Filesize
468KB

MD5
21d28edf317d05a944dfed4c8245698d

SHA1
c4fead894206f62646ce0b97bc655b99b0df94dd

SHA256
b917469ec35503bf8920c0181cc85331387297d0e9f33adc0fcf8e8e0364e0f0

SHA512
cf297d2365be70df3b61b2e28a3c272665d62a2a9d10bd5f702368ce86da4c8045e5ce96a320c0c66152cb364c317bf1bdbaa41c35ed5b5a42c824a99c6cef61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35690.exe

Filesize
468KB

MD5
557a1552355cb5a7e67e59fbf0edf254

SHA1
0a67bc569d82dae765618fefb82bd3f17001034c

SHA256
f727f866abe393dc4a246b23caf319200d21d0e03d5954ae40f7cf33d0801e1d

SHA512
30966cced3142a40d3fade7149a92d5f73c131b8417766d855562fa9fd26fcbea9e691c88a50498cfe397375e55b524957c5ffcc05cb9685ed64f1cd25b57ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe

Filesize
468KB

MD5
d370cba77ad276ace3f326f933f58d15

SHA1
fdf678b5eb5bed3a0d66ab903d884ec13dba6cee

SHA256
90f03ce36067f16c852846f4cb7173052125c70ca9226c0e0e4bf18661ebf98a

SHA512
01cdc6a52381025ca5ceb7d7dd62347f6261fad29427da83f30f3f09e947932f90a56311278187b09e20318720e286f14f23adb1940d80a59f602ddd5e65d4e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39648.exe

Filesize
468KB

MD5
cb8a749f3c1997c4ce749e591dacffc2

SHA1
5c49ef0ba4441c3280807b94e0754c3f4dd40ced

SHA256
e1f50ff13e4582c4a6c6624341e737d7f25fa2ad7e7204df0a09dd5b8935d410

SHA512
ef7f08cad31a23665d74c70443035bd4ae3e04c30e0783ad8d5d9d99ea5c6335accf56f25cf84e5166cee8ca180b15826f778cab7496ab50246b9fd9ecd23c94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40594.exe

Filesize
468KB

MD5
8c2be930fb09f103c30d883239f3a9a9

SHA1
f202e4c767baaca2ab1c43e71800a9a054a9336f

SHA256
20e99339f549cee1ab237a806286ce646f305510c0e776e23303d62834d03088

SHA512
b2bb2a681c51a6c2fdbc6a85b47eed74208a09ec6ff84582d8f840122d196538c5c24cbc26cd61ecf34eb945a8274f3fcac2f07e9e9d9bc03e0c9013c79f2639

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46810.exe

Filesize
468KB

MD5
939786bb366ef4adccd9a32a416b0070

SHA1
26e135dd6f52070328386b025eb7280e2e998dff

SHA256
a1c6d21ea110caeebd628aee737196518c5074edff6e06b4a6d21ae50411c8ba

SHA512
14ab90227bfda31270374300984e07fcecd575e1f6c93afe4d7bcfc33ca043d30a54eb9218ead534c6951697977bca7350743b142f5aeec92cbb1863047562ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe

Filesize
468KB

MD5
4edfbf4caea6c5a5a484dc4aed5c7e49

SHA1
bd6ecffb79f38eb864eeae43067b248c4c9489c2

SHA256
e3ba80b148433bf16384632188b3f7e4e5039218be6446aaa56cf965574788fd

SHA512
cc305ff5c90df3c56358e351b2ce79e0d1eee48bc066355cce25bf865385ddc924265a337353e39f250d154db246fdb10c17768eec9e8704eb20b1f489c16213

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe

Filesize
468KB

MD5
c88cb9848f90c2a8fbcde7325c0bbb29

SHA1
f04987dbee04de693237ed90e0581926c83ab41e

SHA256
0ff9e1395fa178a9c011b7f06364df8df1bc494629ad5088cf4d69fb799508ac

SHA512
8d49bc3a812821c37eddcdd06bd178e8bac4c2c8f3e737909ff8598b53efdc32e4a7c9de7f0cd47a866c6a0b89fd35c73a6b2bd3695e242d35a03d24678b3e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe

Filesize
468KB

MD5
202920b43b2bd15854a69a3fa0471400

SHA1
7bb71d3feda0c663a14b8bfc307313844d13fd1a

SHA256
a3cd3d5d12d65f89f23b21dd8106bc9acaf0b475de1f555f464122cc9a835047

SHA512
95f10762317473965118f6b947cb2d7e2a4bbf6d9336cae748bad17bbbf1abda3c90b9304972cc1c3af443b3947291c9f39f6fb3fa7161eb93541edba0fbe3f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe

Filesize
468KB

MD5
1295e50d9f8b9e0cf93e222d96c202df

SHA1
499456ba14c953765bdac504d67e36473af9d781

SHA256
b5ec02ca6fc74180697a325e7bb208a9fe36d874986caa48e77ba453e0c7f636

SHA512
934a8d28147a3b68052c79478bc6c57c9203eed2fd7229b400daa0a7818c8109dc985eef17d22e1758a9e775f1914252bec572476e599426718c0d48b4ce4819

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe

Filesize
468KB

MD5
eb6b18385a4d2711f85d9443916a7f9e

SHA1
04ee2483bdf4e19ab683741c5a2a11b4f24cd4a0

SHA256
c02ca9eb96e48f09325b45db226c0ef64ef04e8c8a69021d2ad4527e39a866a4

SHA512
723927df8867ed7fb3df78c29979967fc751d6944a9b8036b2cb4cc52e86ca3850208eb9bdb21d06e2171da22b1df43875881875f9679a8106bdd0d45a5c9322

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51273.exe

Filesize
468KB

MD5
36875bad420ab3e9f2066840e24d25c2

SHA1
804b00d9db38f921ff6682424241eba764033b5c

SHA256
816b02eac6c1d01ae1a9ef1e6a2a70281b4c9cdf0d013cc19ffab6906a095472

SHA512
b284ddd5a7feeaeb9395003adca56fea5bfb092656e8d31043ab405c5ac0b1486511a0553a6b0a74a852fdff57910808dbc20966dc40aee18bfb0d3a95f906d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe

Filesize
468KB

MD5
d3565622296cacd196fe553607d77043

SHA1
1d59e368a77bd8912ff79b626112075347fbe7af

SHA256
ace627e0f30be55257151596d12a901603a8afbc037229871d4d5f4f528c508c

SHA512
4c780029a17a4b7c54485825174a5afa9f43570914ba8d9912a959ae26d9abe3c46cdf369881951aba770f12e0f234b3e7eb763e7f575fd931e1b17be3317a89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe

Filesize
468KB

MD5
b4821db83cc2aa392c2158ccddb9f371

SHA1
34c0b229b0ad301d7dcb22f3363854df5b94b336

SHA256
a3428a20a4ba1eb089aeee9b01d35ae4a5092f3d768b973cd2d9252058e685f5

SHA512
5bdc2f194b4195a258a6a92fd0c6dac898c5b406b34e26956b268f908029bf40f35f9f4eb8aef6ca281f768c5b16926e91b3aeeeee1c5abf83310e08f628890f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe

Filesize
468KB

MD5
c219459a51af3a36f9c4be03903e8e61

SHA1
0a0c830bcd00387d965f47c13331b42fd4ca73a9

SHA256
21af6ac0cbbe8bdcea5ab32a5fa98af8759cb8817353858cd38c701ec02f0406

SHA512
d31087f733e34a6d67d422cda0bab3a29a07e3e99623a703a5a3ae70883938102a88d1141fa7925df7bc75052553da6a7af1e292a1df6c74ca7ebf52bb5b23c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe

Filesize
468KB

MD5
3382cbb19affb037de2090b19f8e33af

SHA1
f45474b7428eb7c649cbc6377559ae2702863290

SHA256
5e3fb98d9f91266bd36befbaaa0162d79d34427f1ccef24e2f2835a2cdc4d00c

SHA512
7245dc1b139e0e0ae5cd35b04e66b5df621a759b300e51a9baa4bd8d0aea736cb82c4851518f9798ac4cf31c95589f06a9c12df6e7edc9f5f8d103bc1f8bf118

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56722.exe

Filesize
468KB

MD5
4740f201b57baa8d71c6524e2b1a010c

SHA1
81175c8b635527bffd63b1ea6fffe09d8ed0db4a

SHA256
417e440c303b53b479a3e448ab7ad11411402cd056e383fce911d0fb94b5dc6a

SHA512
35bc916bf24618f9cf48d06a9bbb6f830e12c9ebd890201a983348159b72ce077f50ab9f0812760e13125d687255c423291a9b962be05b8eabb27f8deed5f805

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe

Filesize
468KB

MD5
d1119b71b27cf2fee3e60c6a0102377f

SHA1
6f25657009feb8fec7906a58d9c897e07f9006c9

SHA256
9abe66c812a999ce0ad1719f789ea2fc1dd29164a3ad330ab3dde8084714c887

SHA512
c06c1932fd9086b8fa7c5bd16a63595aa30b2ea5c45882325bd47592e00ec08cbab2b3db35de282e1cd362ae903a3387a214ade06291d384e71003ef8095e41c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57994.exe

Filesize
468KB

MD5
aaaefc3dfb62584c1a4338a0e5141334

SHA1
c669644b045fc63937f6f2cc362f4e35dc0a3ce0

SHA256
9a3b719113cc48c3d8b22bc5dc3bf0034664d7166378eb849b4691e8578580de

SHA512
f9139e137478d4d5cecc42329d2b7380f95dab38aaec952c977daf7f5bb9dff76b57485442b90c4e56ef521b1fc54639f6fbadcdd689d26e0dd1a8352d24aa26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe

Filesize
468KB

MD5
858ee18c5300b8e44d6f925cc715e1cb

SHA1
a90695416fed4716ab188949b8b27f41eeeba034

SHA256
cad732dda830847878c6929cc6bdb49d4ac6eb74d52aabbd961b52fba10cfb14

SHA512
12c1d7e85f2aa7550144712da390de28cace566997051ca4ac6e11b2f8f92c89e7075fa4103332417525d91b0b320c9625d27ba24a88dae85087255d2a204516

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe

Filesize
468KB

MD5
25973ddc0986fa4dde531ba662924a4b

SHA1
32d033d972ba6b17c698c1f0aadcd5d76e3b222c

SHA256
4a9b3818aeda219d12c9d3e4625715c7a13fa49473056a5774112646c9a3eb6f

SHA512
8192abb68c23315706f0593bfa3f89f9c627fdd81f9e753a1b0088e45c08dbb947b00e6b2a2cd55c28650079319c4b3f4295978a5affeb85f346ff7908982408

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe

Filesize
468KB

MD5
41643c994648de46f8209cddfd2a2270

SHA1
eae51be5fab1493b993345c0b69d3edc04496006

SHA256
6e27006813c58b2085cd8ebcb51ea3553ed40efb99ab7eb8ca167a4ccd22c845

SHA512
a9583d91ae70767a4a800abc3c5fed8870e97f0744565e73ff25ac0ddf729ce9e53ff88ac0dec31ecc6033308be2f15fea971e830677b87a2857e1e6cc7b99b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe

Filesize
468KB

MD5
1b28be597694dbd4622274fdb989b939

SHA1
5105bd396118bad261691133bb01ca3bc8bd3ddc

SHA256
d301a0f27a759f344d3c180c04fa4e3556157352e3da28f5042ffeedbb15085b

SHA512
ddb087b0241a7dd291532ac2eeb3711b45dc9198c28b93d773119ed9186267ce737c0ae9579892d0ae4d3cc8b6cbf50440a957a2b574e95051edf43fc1760621

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe

Filesize
468KB

MD5
e6ad15da4f40fc691ba97a182603b2b9

SHA1
9e10921f4c1155666b2b0e42b69158aaf832c6c0

SHA256
466064dbf201162f347f26b54994793df9b57823d1b6999303a52d933a129410

SHA512
a4eafe97004d25557a140ca4c99ce7a77c92d4dab36efcf8965158c81746d8c282a16ee3de0351e470aadd58894966c78b5c69dd05129b4b0473dfc2a66e7b99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe

Filesize
468KB

MD5
ce5b0b9bbb3121d4d95b9e6be9f2e302

SHA1
37a30e7585102c4b2887853ccb37a3300d807925

SHA256
d52df61017d691f23bbf2170cc4151296f4374937ee0d3baf313f4968a9db994

SHA512
c11478f93be111a861e50f7ef134492fa05d1a6628b13a3081460b27b059e30eee6b72c2fc624bd2dc6840f3d960e1883ab7b1d74afa78d779b0baf1436601d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe

Filesize
468KB

MD5
71d058a679737cb53aa9df8274cf936d

SHA1
9e0e6dcfe344c0bdf7f428d76c36c936c465a351

SHA256
0fa80321d120c66cd7cebf610b1fabea851cbc3ce89caf36ace78cdb8a919a11

SHA512
62de7d2f81a447585e8059fe6eeef4f3b3171d613a4030498620ea9fe8d51ddaeaf56c37a2828b85ec87a5890acadff60234ed049547b01b67ecc7ef94e07ce0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe

Filesize
468KB

MD5
26464be66d924749b1bc5e131ba60253

SHA1
a9ce36cddf07a2239d5c0a91369ab22c64c47abc

SHA256
223a2264c8c66b0969142730f0a1fccafe87129198329fc000dfeeb74f130ede

SHA512
2af8a82edd07c1c449a2353da5fb1322cae5fbc2c5f8f38ff81d2e62110d16f2327c546e93aecf5110d84d7e2e6413fdb3eb198462e16f6fb244bb3ab193bf79

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads