8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7c

Analysis

max time kernel
118s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe
Size

468KB
MD5

95e16c95fbdf7c23a7d320c1d3e8e700
SHA1

b4bb146159ed4b3ce6fc3d0a977ec6c07b868d60
SHA256

8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7c
SHA512

68a7d84a15d58177762187fd85fe986a5ae61d78e839cec05e1ed9515a75adfeaf275791f87dc09aef81b8bfbb0e8b4075eef520dc28afc33df7a706527b9b58
SSDEEP

3072:Oco9ogIKM05QSbY3HzcO2fr/GC5zP0pGNLHeaVPKZwQAO0DgkOWZ:Ocqo/8QSMH4O2fJY1zZw9/Dgk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2556	Unicorn-14427.exe
628	Unicorn-56503.exe
3476	Unicorn-9310.exe
1360	Unicorn-58999.exe
4628	Unicorn-12574.exe
2412	Unicorn-28356.exe
5112	Unicorn-14057.exe
3028	Unicorn-43068.exe
4408	Unicorn-30301.exe
3620	Unicorn-22072.exe
4432	Unicorn-42169.exe
4908	Unicorn-62035.exe
408	Unicorn-38408.exe
372	Unicorn-25891.exe
3348	Unicorn-20025.exe
3168	Unicorn-32544.exe
1996	Unicorn-41266.exe
3576	Unicorn-146.exe
2380	Unicorn-11636.exe
2416	Unicorn-25144.exe
4576	Unicorn-19725.exe
1460	Unicorn-19991.exe
3904	Unicorn-33312.exe
1408	Unicorn-33312.exe
3268	Unicorn-53732.exe
1276	Unicorn-39434.exe
4888	Unicorn-8615.exe
1092	Unicorn-46533.exe
3284	Unicorn-32797.exe
4584	Unicorn-5470.exe
3060	Unicorn-14583.exe
3184	Unicorn-11054.exe
4264	Unicorn-21683.exe
224	Unicorn-35973.exe
1420	Unicorn-9221.exe
3860	Unicorn-55315.exe
3236	Unicorn-44495.exe
2280	Unicorn-42871.exe
1308	Unicorn-19626.exe
4760	Unicorn-56083.exe
4040	Unicorn-4422.exe
4604	Unicorn-12995.exe
4340	Unicorn-33416.exe
1884	Unicorn-33416.exe
2760	Unicorn-12233.exe
4196	Unicorn-25802.exe
3000	Unicorn-551.exe
2184	Unicorn-33970.exe
1544	Unicorn-53836.exe
2636	Unicorn-58859.exe
1644	Unicorn-5019.exe
3896	Unicorn-5988.exe
4932	Unicorn-12118.exe
4352	Unicorn-21356.exe
2596	Unicorn-37692.exe
424	Unicorn-37692.exe
872	Unicorn-24925.exe
732	Unicorn-44526.exe
4936	Unicorn-62367.exe
2044	Unicorn-10565.exe
4564	Unicorn-56394.exe
832	Unicorn-24947.exe
740	Unicorn-45367.exe
1608	Unicorn-54604.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4024	15644	WerFault.exe	762
4748	15996	WerFault.exe	799

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15149.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2020	dwm.exe
Token: SeChangeNotifyPrivilege	2020	dwm.exe
Token: 33	2020	dwm.exe
Token: SeIncBasePriorityPrivilege	2020	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe
2556	Unicorn-14427.exe
628	Unicorn-56503.exe
3476	Unicorn-9310.exe
1360	Unicorn-58999.exe
2412	Unicorn-28356.exe
4628	Unicorn-12574.exe
5112	Unicorn-14057.exe
3028	Unicorn-43068.exe
3620	Unicorn-22072.exe
4408	Unicorn-30301.exe
3348	Unicorn-20025.exe
372	Unicorn-25891.exe
4432	Unicorn-42169.exe
4908	Unicorn-62035.exe
408	Unicorn-38408.exe
3168	Unicorn-32544.exe
1996	Unicorn-41266.exe
3576	Unicorn-146.exe
2380	Unicorn-11636.exe
2416	Unicorn-25144.exe
3904	Unicorn-33312.exe
1460	Unicorn-19991.exe
4576	Unicorn-19725.exe
1408	Unicorn-33312.exe
4888	Unicorn-8615.exe
4584	Unicorn-5470.exe
3268	Unicorn-53732.exe
3284	Unicorn-32797.exe
1092	Unicorn-46533.exe
1276	Unicorn-39434.exe
3060	Unicorn-14583.exe
3184	Unicorn-11054.exe
4264	Unicorn-21683.exe
224	Unicorn-35973.exe
1420	Unicorn-9221.exe
3860	Unicorn-55315.exe
3236	Unicorn-44495.exe
2280	Unicorn-42871.exe
1308	Unicorn-19626.exe
4760	Unicorn-56083.exe
4040	Unicorn-4422.exe
4604	Unicorn-12995.exe
4340	Unicorn-33416.exe
2760	Unicorn-12233.exe
4196	Unicorn-25802.exe
1884	Unicorn-33416.exe
3000	Unicorn-551.exe
2184	Unicorn-33970.exe
1544	Unicorn-53836.exe
2636	Unicorn-58859.exe
3896	Unicorn-5988.exe
4352	Unicorn-21356.exe
4932	Unicorn-12118.exe
1644	Unicorn-5019.exe
732	Unicorn-44526.exe
2596	Unicorn-37692.exe
4564	Unicorn-56394.exe
4936	Unicorn-62367.exe
872	Unicorn-24925.exe
2044	Unicorn-10565.exe
424	Unicorn-37692.exe
832	Unicorn-24947.exe
396	Unicorn-6756.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 2556	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	86
PID 4020 wrote to memory of 2556	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	86
PID 4020 wrote to memory of 2556	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	86
PID 2556 wrote to memory of 628	2556	Unicorn-14427.exe	87
PID 2556 wrote to memory of 628	2556	Unicorn-14427.exe	87
PID 2556 wrote to memory of 628	2556	Unicorn-14427.exe	87
PID 4020 wrote to memory of 3476	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	88
PID 4020 wrote to memory of 3476	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	88
PID 4020 wrote to memory of 3476	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	88
PID 628 wrote to memory of 1360	628	Unicorn-56503.exe	89
PID 628 wrote to memory of 1360	628	Unicorn-56503.exe	89
PID 628 wrote to memory of 1360	628	Unicorn-56503.exe	89
PID 2556 wrote to memory of 4628	2556	Unicorn-14427.exe	90
PID 2556 wrote to memory of 4628	2556	Unicorn-14427.exe	90
PID 2556 wrote to memory of 4628	2556	Unicorn-14427.exe	90
PID 3476 wrote to memory of 2412	3476	Unicorn-9310.exe	91
PID 3476 wrote to memory of 2412	3476	Unicorn-9310.exe	91
PID 3476 wrote to memory of 2412	3476	Unicorn-9310.exe	91
PID 4020 wrote to memory of 5112	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	92
PID 4020 wrote to memory of 5112	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	92
PID 4020 wrote to memory of 5112	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	92
PID 1360 wrote to memory of 3028	1360	Unicorn-58999.exe	93
PID 1360 wrote to memory of 3028	1360	Unicorn-58999.exe	93
PID 1360 wrote to memory of 3028	1360	Unicorn-58999.exe	93
PID 628 wrote to memory of 4408	628	Unicorn-56503.exe	94
PID 628 wrote to memory of 4408	628	Unicorn-56503.exe	94
PID 628 wrote to memory of 4408	628	Unicorn-56503.exe	94
PID 2412 wrote to memory of 3620	2412	Unicorn-28356.exe	95
PID 2412 wrote to memory of 3620	2412	Unicorn-28356.exe	95
PID 2412 wrote to memory of 3620	2412	Unicorn-28356.exe	95
PID 3476 wrote to memory of 4432	3476	Unicorn-9310.exe	96
PID 3476 wrote to memory of 4432	3476	Unicorn-9310.exe	96
PID 3476 wrote to memory of 4432	3476	Unicorn-9310.exe	96
PID 4628 wrote to memory of 4908	4628	Unicorn-12574.exe	97
PID 4628 wrote to memory of 4908	4628	Unicorn-12574.exe	97
PID 4628 wrote to memory of 4908	4628	Unicorn-12574.exe	97
PID 5112 wrote to memory of 408	5112	Unicorn-14057.exe	98
PID 5112 wrote to memory of 408	5112	Unicorn-14057.exe	98
PID 5112 wrote to memory of 408	5112	Unicorn-14057.exe	98
PID 4020 wrote to memory of 372	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	99
PID 4020 wrote to memory of 372	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	99
PID 4020 wrote to memory of 372	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	99
PID 2556 wrote to memory of 3348	2556	Unicorn-14427.exe	100
PID 2556 wrote to memory of 3348	2556	Unicorn-14427.exe	100
PID 2556 wrote to memory of 3348	2556	Unicorn-14427.exe	100
PID 3028 wrote to memory of 3168	3028	Unicorn-43068.exe	101
PID 3028 wrote to memory of 3168	3028	Unicorn-43068.exe	101
PID 3028 wrote to memory of 3168	3028	Unicorn-43068.exe	101
PID 1360 wrote to memory of 1996	1360	Unicorn-58999.exe	102
PID 1360 wrote to memory of 1996	1360	Unicorn-58999.exe	102
PID 1360 wrote to memory of 1996	1360	Unicorn-58999.exe	102
PID 372 wrote to memory of 3576	372	Unicorn-25891.exe	103
PID 372 wrote to memory of 3576	372	Unicorn-25891.exe	103
PID 372 wrote to memory of 3576	372	Unicorn-25891.exe	103
PID 4020 wrote to memory of 2380	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	104
PID 4020 wrote to memory of 2380	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	104
PID 4020 wrote to memory of 2380	4020	8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe	104
PID 3348 wrote to memory of 2416	3348	Unicorn-20025.exe	105
PID 3348 wrote to memory of 2416	3348	Unicorn-20025.exe	105
PID 3348 wrote to memory of 2416	3348	Unicorn-20025.exe	105
PID 2556 wrote to memory of 4576	2556	Unicorn-14427.exe	106
PID 2556 wrote to memory of 4576	2556	Unicorn-14427.exe	106
PID 2556 wrote to memory of 4576	2556	Unicorn-14427.exe	106
PID 4408 wrote to memory of 1460	4408	Unicorn-30301.exe	107

C:\Users\Admin\AppData\Local\Temp\8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe
"C:\Users\Admin\AppData\Local\Temp\8e2ae4c4af3c74554b9a91c108ca6c02e96343ba2baee54efb887036c20aff7cN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58999.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14583.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24947.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        9⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37731.exe
        9⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10965.exe
        9⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe
        9⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47086.exe
        8⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65240.exe
        9⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44430.exe
        9⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        9⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
        8⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exe
        8⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11965.exe
        8⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51244.exe
        8⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        7⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15442.exe
        8⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        9⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        10⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28914.exe
        10⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9962.exe
        9⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        9⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe
        9⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        8⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8078.exe
        8⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
        8⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48449.exe
        8⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34474.exe
        8⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46601.exe
        8⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        8⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        8⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
        8⤵
        
        PID:15644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15644 -s 464
        9⤵
        Program crash
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        8⤵
        
        PID:16924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16402.exe
        7⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        7⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11054.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45367.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61628.exe
        8⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        9⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
        10⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        10⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11865.exe
        10⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9962.exe
        9⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        9⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        9⤵
        
        PID:16944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20521.exe
        8⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
        9⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42702.exe
        9⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45818.exe
        9⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        8⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
        8⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48312.exe
        8⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58867.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2614.exe
        8⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        8⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        8⤵
        
        PID:15864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
        7⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        7⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        7⤵
        
        PID:17264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
        7⤵
        
        PID:17224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
        7⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56444.exe
        8⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
        9⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
        9⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        9⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        8⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9380.exe
        8⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
        8⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
        7⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17348.exe
        8⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58021.exe
        8⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22649.exe
        7⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-990.exe
        7⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37627.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30871.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        8⤵
        
        PID:16944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
        8⤵
        
        PID:17128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        7⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        7⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
        7⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3824.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22891.exe
        6⤵
        
        PID:15092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        6⤵
        
        PID:17252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5761.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
        7⤵
        Executes dropped EXE
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
        8⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        9⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65100.exe
        10⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        10⤵
        
        PID:16768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28036.exe
        10⤵
        
        PID:16692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        10⤵
        
        PID:17164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        9⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57731.exe
        9⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56096.exe
        9⤵
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
        8⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60611.exe
        8⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50374.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57082.exe
        8⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18109.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40819.exe
        8⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15982.exe
        8⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25973.exe
        8⤵
        
        PID:17368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        7⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5781.exe
        7⤵
        
        PID:16720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51459.exe
        6⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64036.exe
        8⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20902.exe
        9⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        9⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        8⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8996.exe
        8⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50175.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32947.exe
        8⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20746.exe
        8⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        7⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
        8⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
        8⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20112.exe
        8⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52006.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38702.exe
        7⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
        7⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46231.exe
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5826.exe
        6⤵
        
        PID:15132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5349.exe
        6⤵
        
        PID:17128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe
        6⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57544.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        8⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32096.exe
        9⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        9⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60569.exe
        9⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        8⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12221.exe
        8⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        8⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57871.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2709.exe
        7⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32925.exe
        7⤵
        
        PID:17368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34096.exe
        7⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23070.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11063.exe
        8⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34639.exe
        8⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30958.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50138.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        7⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16366.exe
        7⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22153.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe
        6⤵
        
        PID:16252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50447.exe
        5⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        6⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        7⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        8⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        8⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        7⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        7⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        7⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22724.exe
        7⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28914.exe
        7⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        7⤵
        
        PID:17268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57870.exe
        6⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49454.exe
        6⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16173.exe
        6⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8930.exe
        6⤵
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31357.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        5⤵
        
        PID:12372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30301.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        8⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        8⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        8⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        7⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        7⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        7⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43268.exe
        7⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23070.exe
        6⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
        7⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12630.exe
        7⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36969.exe
        7⤵
        
        PID:17060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48847.exe
        7⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
        6⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5781.exe
        6⤵
        
        PID:16544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43852.exe
        6⤵
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
        6⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
        6⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19968.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        8⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
        8⤵
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29097.exe
        8⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26158.exe
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59162.exe
        7⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
        7⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-265.exe
        7⤵
        
        PID:17376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
        7⤵
        
        PID:16776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2406.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27345.exe
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29418.exe
        6⤵
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40789.exe
        6⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe
        6⤵
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64991.exe
        6⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe
        6⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21764.exe
        7⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        7⤵
        
        PID:15744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        7⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        7⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
        6⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12510.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50934.exe
        5⤵
        
        PID:12224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        5⤵
        
        PID:15984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23454.exe
        6⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60928.exe
        7⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
        7⤵
        
        PID:17160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40086.exe
        6⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        6⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        5⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        7⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        7⤵
        
        PID:16780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        6⤵
        
        PID:12932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
        6⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18409.exe
        5⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42184.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64602.exe
        6⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        6⤵
        
        PID:16876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
        5⤵
        
        PID:10168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20285.exe
        5⤵
        
        PID:13772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42593.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44526.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41016.exe
        5⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        7⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15021.exe
        7⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33264.exe
        7⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41394.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        6⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
        6⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
        5⤵
        
        PID:14620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14429.exe
      4⤵
      PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        5⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        5⤵
        
        PID:16940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
      4⤵
      PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
      4⤵
      PID:13416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe
      4⤵
      PID:16612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
      4⤵
      PID:17036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62035.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24044.exe
        7⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        8⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17431.exe
        9⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9241.exe
        9⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43745.exe
        9⤵
        
        PID:17000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        9⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        8⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50378.exe
        8⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
        8⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24590.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        7⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39670.exe
        7⤵
        
        PID:16692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41394.exe
        7⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15149.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18217.exe
        6⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48676.exe
        7⤵
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40789.exe
        6⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        6⤵
        
        PID:17352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        6⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        6⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13771.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50487.exe
        8⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8281.exe
        8⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18953.exe
        8⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        7⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
        7⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
        6⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        7⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
        6⤵
        
        PID:16904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        6⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
        5⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        7⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43745.exe
        7⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        7⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        6⤵
        
        PID:16124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        6⤵
        
        PID:16956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32215.exe
        6⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
        5⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46595.exe
        6⤵
        
        PID:16368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
        6⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3750.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5470.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53836.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24044.exe
        6⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        8⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
        8⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
        7⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19245.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        6⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
        7⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        7⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        7⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46190.exe
        6⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        6⤵
        
        PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52147.exe
        6⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        7⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64451.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19245.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56096.exe
        6⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36033.exe
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39170.exe
        5⤵
        
        PID:13196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        6⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61431.exe
        7⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49039.exe
        7⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9962.exe
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        6⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        6⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        5⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
        5⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21550.exe
        5⤵
        
        PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17974.exe
      4⤵
      PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        5⤵
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        5⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39626.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        5⤵
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
        5⤵
        
        PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
      4⤵
      PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
      4⤵
      PID:12392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
      4⤵
      PID:16732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
      4⤵
      PID:5940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20025.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25144.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56083.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
        6⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1275.exe
        8⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
        9⤵
        
        PID:12256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        9⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        8⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        8⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27508.exe
        8⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        7⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        7⤵
        
        PID:15228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11586.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        7⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        7⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        6⤵
        
        PID:16244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7238.exe
        6⤵
        
        PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        5⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39044.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39652.exe
        8⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
        8⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33801.exe
        7⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        7⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53962.exe
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8862.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10000.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        6⤵
        
        PID:16860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16729.exe
        6⤵
        
        PID:17240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65411.exe
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
        5⤵
        
        PID:11804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        5⤵
        
        PID:16336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65123.exe
        5⤵
        
        PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4422.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15299.exe
        5⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38920.exe
        8⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43366.exe
        8⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        8⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10201.exe
        7⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22016.exe
        7⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
        7⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58426.exe
        6⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
        7⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        7⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
        6⤵
        
        PID:11472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57530.exe
        6⤵
        
        PID:16356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51467.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
        6⤵
        
        PID:13488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40730.exe
        6⤵
        
        PID:16548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27704.exe
        6⤵
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
        5⤵
        
        PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8100.exe
      4⤵
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38660.exe
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
        6⤵
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17222.exe
        5⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
        5⤵
        
        PID:12320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17782.exe
      4⤵
      PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        5⤵
        
        PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40486.exe
        5⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
        5⤵
        
        PID:15736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        5⤵
        
        PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16865.exe
      4⤵
      PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50735.exe
      4⤵
      PID:11416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12258.exe
      4⤵
      PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
      4⤵
      PID:6308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19725.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        5⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49651.exe
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33907.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
        7⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48893.exe
        7⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20393.exe
        6⤵
        
        PID:15500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51467.exe
        5⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
        6⤵
        
        PID:10864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43366.exe
        6⤵
        
        PID:14468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        6⤵
        
        PID:15160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        6⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        5⤵
        
        PID:11456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7741.exe
        5⤵
        
        PID:16932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49991.exe
        5⤵
        
        PID:17328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64863.exe
      4⤵
      PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7622.exe
        6⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
        6⤵
        
        PID:17200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        6⤵
        
        PID:17060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37642.exe
        5⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
        5⤵
        
        PID:12328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
      4⤵
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        5⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2084.exe
        5⤵
        
        PID:16524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25531.exe
      4⤵
      PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
      4⤵
      PID:10336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
      4⤵
      PID:16316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48740.exe
      4⤵
      PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20840.exe
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25161.exe
        6⤵
        
        PID:15152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15785.exe
        6⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
        6⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60154.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60569.exe
        6⤵
        
        PID:16668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        5⤵
        
        PID:11780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47747.exe
        5⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28043.exe
        5⤵
        
        PID:16272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
      4⤵
      PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        5⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe
        6⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        6⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
        5⤵
        
        PID:15388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
      4⤵
      PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
        5⤵
        
        PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
      4⤵
      PID:11816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
      4⤵
      PID:15528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
      4⤵
      PID:17360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
      4⤵
      PID:7088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
    3⤵
    PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63460.exe
      4⤵
      PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4571.exe
        5⤵
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
        5⤵
        
        PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
      4⤵
      PID:10216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
      4⤵
      PID:14872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60419.exe
      4⤵
      PID:17248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
      4⤵
      PID:7184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
    3⤵
    PID:8000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59325.exe
    3⤵
    PID:6984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60971.exe
    3⤵
    PID:11860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18482.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 15996 -s 468
      4⤵
      Program crash
      PID:4748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
    3⤵
    PID:16744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
    3⤵
    PID:912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
    3⤵
    PID:6072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22072.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21356.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
        7⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe
        8⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        9⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64554.exe
        9⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57171.exe
        9⤵
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        9⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        8⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        8⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2073.exe
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29802.exe
        7⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19216.exe
        7⤵
        
        PID:14072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65468.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        8⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        8⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        8⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20973.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        7⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        6⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
        7⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        7⤵
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3513.exe
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        6⤵
        
        PID:15032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62367.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15442.exe
        6⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24696.exe
        8⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11426.exe
        8⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        7⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        7⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        7⤵
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3277.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe
        6⤵
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19874.exe
        6⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
        5⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        6⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43698.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6853.exe
        6⤵
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29097.exe
        6⤵
        
        PID:16924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
        5⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50934.exe
        5⤵
        
        PID:12228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        5⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        5⤵
        
        PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32797.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24044.exe
        6⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7171.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        8⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        7⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
        7⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        6⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        6⤵
        
        PID:13204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23526.exe
        6⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18218.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe
        6⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        7⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
        7⤵
        
        PID:16888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exe
        7⤵
        
        PID:17352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        7⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        6⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
        6⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
        6⤵
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6624.exe
        5⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        6⤵
        
        PID:312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        6⤵
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        6⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        5⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22361.exe
        5⤵
        
        PID:15196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27316.exe
        5⤵
        
        PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10565.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35863.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        7⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46595.exe
        7⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29422.exe
        6⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8913.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
        5⤵
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12178.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22361.exe
        5⤵
        
        PID:15172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
      4⤵
      PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
        5⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57368.exe
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe
        6⤵
        
        PID:15344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
        5⤵
        
        PID:13872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
      4⤵
      PID:9876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
      4⤵
      PID:15236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
      4⤵
      PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53732.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        6⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39428.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        8⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27867.exe
        8⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27704.exe
        8⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        7⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        8⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31897.exe
        8⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50802.exe
        7⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        7⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        7⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
        6⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        7⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34845.exe
        7⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36018.exe
        7⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27704.exe
        7⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53298.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57399.exe
        6⤵
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe
        6⤵
        
        PID:17340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        6⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38830.exe
        5⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
        6⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
        6⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64165.exe
        6⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        6⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
        5⤵
        
        PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21389.exe
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43057.exe
        5⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        5⤵
        
        PID:17276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24044.exe
        5⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        7⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
        7⤵
        
        PID:17288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19245.exe
        6⤵
        
        PID:13264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        5⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16729.exe
        6⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63626.exe
        5⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41713.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51244.exe
        5⤵
        
        PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-539.exe
        6⤵
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41514.exe
        6⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30400.exe
        6⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        5⤵
        
        PID:11188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        5⤵
        
        PID:14584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
      4⤵
      PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64659.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        5⤵
        
        PID:15460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
      4⤵
      PID:10480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
      4⤵
      PID:14412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
      4⤵
      PID:16852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
      4⤵
      PID:2000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46533.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62204.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        6⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        7⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
        7⤵
        
        PID:17204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18130.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        6⤵
        
        PID:13848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40641.exe
        5⤵
        
        PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8862.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10000.exe
        5⤵
        
        PID:15712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
      4⤵
      PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        5⤵
        
        PID:9184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        5⤵
        
        PID:13280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe
        5⤵
        
        PID:16836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2754.exe
      4⤵
      PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
      4⤵
      PID:13376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41091.exe
      4⤵
      PID:17112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44277.exe
      4⤵
      PID:744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65468.exe
        5⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20746.exe
        6⤵
        
        PID:16020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        6⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe
        5⤵
        
        PID:9744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20973.exe
        5⤵
        
        PID:13708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46019.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        5⤵
        
        PID:17120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
      4⤵
      PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        5⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63369.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10869.exe
      4⤵
      PID:8640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39667.exe
      4⤵
      PID:12808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
    3⤵
    PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
      4⤵
      PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20695.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
        5⤵
        
        PID:15756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        5⤵
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
      4⤵
      PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33801.exe
      4⤵
      PID:13272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
      4⤵
      PID:17380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
    3⤵
    PID:8016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4043.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1361.exe
    3⤵
    PID:15140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
    3⤵
    PID:12472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14057.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14057.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47086.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12199.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7185.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44727.exe
        7⤵
        
        PID:17172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe
        7⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        7⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
        6⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16445.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        6⤵
        
        PID:16348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
        5⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        6⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        7⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        7⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        6⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
        5⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20695.exe
        6⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
        6⤵
        
        PID:15872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        6⤵
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42739.exe
        5⤵
        
        PID:10676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
        5⤵
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24025.exe
        5⤵
        
        PID:17180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        5⤵
        
        PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33970.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24044.exe
        5⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1234.exe
        7⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24830.exe
        7⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        7⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        6⤵
        
        PID:12656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
        5⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
        6⤵
        
        PID:15028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44730.exe
        6⤵
        
        PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        5⤵
        
        PID:11612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9808.exe
        5⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        5⤵
        
        PID:7304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10272.exe
      4⤵
      PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
        5⤵
        
        PID:9936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        5⤵
        
        PID:14672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27512.exe
        5⤵
        
        PID:17120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56366.exe
      4⤵
      PID:8204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
      4⤵
      PID:12212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21150.exe
      4⤵
      PID:15584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
      4⤵
      PID:4140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58496.exe
      4⤵
      PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        5⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2438.exe
        6⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe
        6⤵
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        5⤵
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4973.exe
        5⤵
        
        PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
      4⤵
      PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
      4⤵
      PID:10672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
      4⤵
      PID:16376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
    3⤵
    PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
      4⤵
      PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
        5⤵
        
        PID:17156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
        5⤵
        
        PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
      4⤵
      PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
      4⤵
      PID:10640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46351.exe
      4⤵
      PID:15456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31645.exe
      4⤵
      PID:17112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exe
      4⤵
      PID:6912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21561.exe
    3⤵
    PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
      4⤵
      PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43589.exe
      4⤵
      PID:13468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39735.exe
      4⤵
      PID:16520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61679.exe
    3⤵
    PID:7232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
    3⤵
    PID:11536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21672.exe
    3⤵
    PID:14944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23125.exe
    3⤵
    PID:1864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-146.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55315.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58496.exe
        5⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        6⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        7⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1129.exe
        7⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
        7⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37524.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4973.exe
        6⤵
        
        PID:17068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe
        6⤵
        
        PID:14032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30532.exe
        6⤵
        
        PID:17124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        6⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        5⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24805.exe
        5⤵
        
        PID:12556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7274.exe
        5⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41584.exe
        5⤵
        
        PID:17080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exe
      4⤵
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        5⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40840.exe
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        6⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        6⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exe
        6⤵
        
        PID:16952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        6⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        5⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46666.exe
        5⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        5⤵
        
        PID:16908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
      4⤵
      PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        5⤵
        
        PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
        5⤵
        
        PID:12840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18977.exe
      4⤵
      PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65338.exe
      4⤵
      PID:13424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6415.exe
      4⤵
      PID:17004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2762.exe
      4⤵
      PID:16436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44495.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
      4⤵
      PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11865.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25177.exe
        5⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        5⤵
        
        PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51467.exe
      4⤵
      PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        5⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
        6⤵
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34378.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22037.exe
        5⤵
        
        PID:15608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe
      4⤵
      PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51027.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23926.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
      4⤵
      PID:13164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
      4⤵
      PID:1388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
    3⤵
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-274.exe
        6⤵
        
        PID:12124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64602.exe
        6⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21809.exe
        6⤵
        
        PID:17296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36178.exe
        6⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        5⤵
        
        PID:14736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28131.exe
        5⤵
        
        PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
      4⤵
      PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
      4⤵
      PID:13452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
      4⤵
      PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17590.exe
    3⤵
    PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
      4⤵
      PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46351.exe
      4⤵
      PID:232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
      4⤵
      PID:17092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59953.exe
    3⤵
    PID:9200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65447.exe
    3⤵
    PID:13252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11636.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11636.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42871.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
      4⤵
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
        5⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exe
        6⤵
        
        PID:14528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
        6⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31808.exe
        5⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        5⤵
        
        PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10626.exe
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        5⤵
        
        PID:17080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
      4⤵
      PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24805.exe
      4⤵
      PID:12568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6145.exe
      4⤵
      PID:6544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60395.exe
    3⤵
    PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
      4⤵
      PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
        5⤵
        
        PID:10616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe
        5⤵
        
        PID:15600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32576.exe
      4⤵
      PID:8492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25111.exe
      4⤵
      PID:11944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24361.exe
    3⤵
    PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35972.exe
      4⤵
      PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
        5⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        5⤵
        
        PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22510.exe
      4⤵
      PID:11828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
      4⤵
      PID:14028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46751.exe
      4⤵
      PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
      4⤵
      PID:6736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59050.exe
    3⤵
    PID:8324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58431.exe
    3⤵
    PID:12884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37360.exe
    3⤵
    PID:17300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
    3⤵
    PID:17052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4993.exe
    3⤵
    PID:7172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18232.exe
    3⤵
    PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17088.exe
      4⤵
      PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63460.exe
        5⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43589.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58126.exe
        5⤵
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
        5⤵
        
        PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
      4⤵
      PID:9276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
      4⤵
      PID:13444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
      4⤵
      PID:6176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39214.exe
    3⤵
    PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
      4⤵
      PID:12620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
      4⤵
      PID:17128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
    3⤵
    PID:8604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe
    3⤵
    PID:17120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
    3⤵
    PID:7240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49795.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49795.exe
  2⤵
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3766.exe
    3⤵
    PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
      4⤵
      PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        5⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4273.exe
        5⤵
        
        PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
      4⤵
      PID:9596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8996.exe
      4⤵
      PID:14212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
      4⤵
      PID:16296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49843.exe
    3⤵
    PID:8848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35365.exe
    3⤵
    PID:12636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
    3⤵
    PID:16836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-795.exe
    3⤵
    PID:17364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1293.exe
    3⤵
    PID:2700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
  2⤵
  PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15551.exe
    3⤵
    PID:8112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
    3⤵
    PID:11956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40486.exe
    3⤵
    PID:15764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
    3⤵
    PID:6212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
  2⤵
  PID:8408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45134.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45134.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
  2⤵
  PID:16148

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11054.exe

Filesize
468KB

MD5
5b762e9e36851f2cfa1212420babf52e

SHA1
06a559bae3e24080e523de485c8d9491d3342208

SHA256
abb13d586fde5f9bc2aec7e1291bc7ef58535c4bbb950d5fc8e35f335cb52446

SHA512
00936631d96c200e54815819241edcefe8d5dab35532d2184dbb78e80f4a685ca95300de0096777b6f39ce2f477d46ae882acd91194e1c73de41ee3641fb6cd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11636.exe

Filesize
468KB

MD5
95912f9a9f94f9432bb4b6d4ed6fc900

SHA1
fcc6b30fce05ba480e459dd3b8a64956f545212b

SHA256
df6cd000280305ab2863a49da46652196149dd44558fced39616445fd83627ac

SHA512
df53c3f1726d732786f0ac0b44ce90a6ac60b9f133e5e9a2e6cab6059916c8eb33eabae15d107e2aa7e60e1c6a55c956994c7f8e3904572e832a4c2c54d09ff4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe

Filesize
468KB

MD5
6f5df575ce470f6e371322f12f614c72

SHA1
a8165fb721e04e46397aab2ece938a3da8a4aced

SHA256
53deecb85a0accf766600c649360f86eb035d541fac8e358c0396d415f7d77a3

SHA512
c3da4e91db1d471576668117914cf3db51dfda1a46da63d3b037901f8298589ce2924ad991ab75753c3e3737409f81683e8104ea4dc70fc491e4748fd2120e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14057.exe

Filesize
468KB

MD5
d7388abcd6a50042d59fbc9e0f4eba2c

SHA1
27424aa4e62af89485462a450420492555aaf9b3

SHA256
2d42f56f184e03ae961755729fa3b04b05c7ead5ad154a5d6a0b412e0d03f92d

SHA512
07a3cbb16f10750cb10dd6ba330f2d739f24f14feae5329cb6f4509938d152b8f3b55a7409f71efea52cf4ef5618c29c9261031b9a521df8c6dcaf584adbbfd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe

Filesize
468KB

MD5
b8bb1af38e94c307a4491fe3a943ffa1

SHA1
93c743e880a7a2ee375ab270408712da991f5b4a

SHA256
5891c411f73c3fb3e5156b1541e9a177346c2c19117f8ceb8c93afb77709537c

SHA512
b4ef45e04d61ce7fa3dbe6aabdd4ed28b2d3e497d8c4ec6b5c018e186ed88eed7ae02fcf75853a7cc64eabf795cbd52cfdb83a4d8d4ad2173a9a4b3db244a5e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14583.exe

Filesize
468KB

MD5
c5fce376d710bb03617066dc40777c56

SHA1
a1b4312818c1d39ff192b872de5b063ae3b98533

SHA256
47d30c051afb8f4620a4a3c9b2ab411d22ba101c4dc946ba8b37ec608b73a60b

SHA512
6cc2cba1244e11103eeb16e7d138c090c910cef5d3e0d3290721b90005a2d18849b09eb7d0f63cd4c39bb294e090289f0b8cdc35accc3d9108c45bc24042b6f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-146.exe

Filesize
468KB

MD5
253095f571425ebab21e3b8ff601c7ec

SHA1
85095041305f2c9229d4e42c3a80e82d74634657

SHA256
a565f40aeb403ee83a580c32a828d2cbe559a842fd67a0011b2b1509a63ca4db

SHA512
e78a412a27d040decacd757d69bb271fed1386e9ee01b62e5ec673376b43afddb1623828646277e9fa3abefefc3a0c13b1bdf1d59528bef9bdda8cfa9534e1a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19725.exe

Filesize
468KB

MD5
68572e2b17067bb79ba0790a5b77790b

SHA1
180ad0f4b27aea42fe76e025794746b445660657

SHA256
39a18454f2290e4ad6ab152c911cd5a177e370029505c8d9eb5d8f6228d78cdb

SHA512
5645b7320becc79e033771e5798defd9fc7ebc3a1037375610836fccd885c0ac9653b0af1cd4a50ed28360cf5981fbdee03e22c9997d91f85285612a7c54a71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe

Filesize
468KB

MD5
f805d381890276c0293f0525e7743b21

SHA1
95cdf616d9a10098ae3130cd0013443a9f9a0bc8

SHA256
a126b080d3bc52f5e38323ccdac9a199906b1ee866c0a55d20564cfae3c6a5b6

SHA512
590d86f2ada17307b3f88601700a767b3d7b9ba38cb67b1607f797924e388c88c263745fc6d951292d5bff81b6c82758729bb095979d6e42496aedd7e8427e45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20025.exe

Filesize
468KB

MD5
9f2c66473875384e3e10d788f23bdb77

SHA1
c8a3accd90d0dd83c8de612abff3961fe1be1b87

SHA256
4caa16cdb9b90d463da4448beb319c4f614c2dc776ca76eb264f5e6ccf3636a1

SHA512
d2767b21fd6ba5da547fb09483da1a4f820b327fb899106c00aed95ca80daff7cec13d9bd90621f07393b5d3abeacc592ce326f14f47e886b313eea6c5b06afc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2084.exe

Filesize
468KB

MD5
5583e35880417b75c5347f3741b61737

SHA1
a36ef5623d8dae06930a66567d5a8556184c6425

SHA256
d4aa30afe69c3db9fb46d22d9ed665b754cc74f5840485955739843a8545e556

SHA512
fc39e0495f4004f900f82cbce4c723c00f2d5ae7a6091c7740298f33190aed1b0ad2b66183f8f44a8034c5c194beef9e542bbc9bb57e056f8777caf82e2f2eb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22072.exe

Filesize
468KB

MD5
7bf547744073d1ba6a2b085fc0a793b2

SHA1
78bf2911826354faa3d0bac53c7bf068a4f047f0

SHA256
c6d4ab66380f667a9c50b49dda2a05235969fe863bcc3c517c827a57bc2e7a85

SHA512
08a5d5886b5a4754ade8698f7c79c50610ba23df40dcc8c69463a3607318f846dcdc7ccfe7359dcaa29bf7e8175a04a26120cf55aa8a2336d650caffa0533ad0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25144.exe

Filesize
468KB

MD5
3ade0c4cf9b582af84dcdeaa4bd07dbd

SHA1
cada26f47c3463df66dd788b0f7dbff723683da6

SHA256
a997eb686f04effeec1fb285e6774eea636750762e6f383342e9be5d4cffa92a

SHA512
2fcbd713a35f0716d11cc233935c735a26ad9d33f68b27598acf8dba9fc74b7ee34af9c1d9a487d0ea189ab003a2b20877f3f7f5a32db4d3303aff951fe8f868

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe

Filesize
468KB

MD5
f3fd8ee16c55011eae665363888a03f1

SHA1
99eb2cac6e17ee3227f9769832356da581744233

SHA256
65709ee6c24aec54c30b2592fd363753497410a21732dc2fae783f645b936c91

SHA512
d4162971ac17801ba16110d9d33f97555e871fffda1218141b0664fd97e321eb96c90711c67a97b97f666bba643ff5178de2ef7e9b421eb28bd95a37b7f45cb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe

Filesize
468KB

MD5
248a00efa51aff5fb6f752c688633e85

SHA1
965d2696937f850d006cdfaa70bea9b21d1b7691

SHA256
66c73854d9545aea7d878e52c6f79e923f6c93887e7dfcb0381fe5839efec0ba

SHA512
6a702198d2002ad9fb6ec4113bdbda1e702199dcd2a0ff3884afd2315cb8fed0faa576eff9b40953ae50cafdb48b8290c4cab2722dbcc555acac4e44d23bc82c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30301.exe

Filesize
468KB

MD5
558ec8af058981b9784e8234740b1301

SHA1
ab131e6946a1c02a62300fd5dd020ae98c2a9701

SHA256
6434138926062cf8f89afa9e5cc4e51c9b233f7b8e003a55481c30bbd3cc3fcc

SHA512
c7db7333c2e3e23f28d104d12197bded7a94b53091db81fdbfabfacef1c7d3790149de065781b981bb74702d503f602006d5dc43536357ce6dd48ee81444c8fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe

Filesize
468KB

MD5
c32823e37d9f5a6fe7babc04f6f6b3ca

SHA1
1e34ccc859bdac0666c1506f937c6d9f91fe1917

SHA256
9fa334fd64ae7cc263bc8dcb7c2b185bc44e5ead0ebc7ee223d97a1821ebdc6d

SHA512
b79c9f1b80f4dcae980e2864921f1f92aecf0117a83b27ebe562cd8aabf06256fd6b72a4efa98db4cb22ac8fd246719a785ca8cb086374effd472406d0978246

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32797.exe

Filesize
468KB

MD5
7ecc0866ac8d7e049896fa9a867c301c

SHA1
0b4d84b28d560b76504cb8d6d157300947b83620

SHA256
03bc31d846c29f0e4b64d412710f919868dfd106666562f1a51ba82a1ea0419c

SHA512
605c16b833c988d70adc19d115304e46dda6bdd9525dbb259b708a7d292476fee5c2a01d49f32ac663d847212a1881036eeb7eecebd644f33490289f34d56078

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe

Filesize
468KB

MD5
2ab1d66826267fdf9f87fa215c949670

SHA1
ac9dde1cd0267d451c7cb1791b5c034947608a37

SHA256
81da79d7978c3c3d6c01468fd25d03ebb55431c78d0bac71c851aefc832cf19a

SHA512
501fce14558a07128f32f37cee73e19ba25c4552c37d69b92c26473dd028c84dd3f084b04b6b01627e2b7518c3bd813e14defa968859843081368e3948ca987e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe

Filesize
468KB

MD5
c9a6d3892e975b54561be2fd621f3fb4

SHA1
d75759c70346d7849d8b5934e8575810c8c93aea

SHA256
394cd9acb00999fa3f48fa1c850d398be7489675de36c4fdc2a9244979d673c6

SHA512
abf85a3dbde386a708a4f22501d9d90a902733d39842b82a2b6d63220a7bbb799d6cd430c9398d25597ab9c584e43625c9cfd702713dbc786eea062555fc22ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe

Filesize
468KB

MD5
5a2196c6e1f82707031eca50b1b22925

SHA1
38fc632f992257dc41ec4904145e966fac003d9d

SHA256
1e79c64d03658514cf9dec364ecd98bda6a3f171436954edc0338567bf7610e4

SHA512
155be3f5cc76f767bbd35e32ba63166651df2d21f6e06e1a32db2df1c7ae02cb6be5c2dd61606e14faa57925fc73117246f4de73f29145c631df218d12b0b12a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe

Filesize
468KB

MD5
c958ae518dfb033927b4fcb99cd17a98

SHA1
0158c0d549ed764a99e60bcd654dd02634c4254e

SHA256
586b692c415087e6d003ed96842b246418d4e3c630e7311f03568fb7a565e721

SHA512
996bb452a2db4c1054f9d3502768e91c1d7df1358827fa65def680354202d8b19d8b21f1d3d9cd995d67dec5b86569eda638e0d15875853b597401116deb2ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe

Filesize
468KB

MD5
365154e5d17caec58e64a6f868ab0db7

SHA1
638188c39385b538caacaee6ece6b762a0c2a679

SHA256
9ef3adeee652d9b52aae1cc7e6f904c8476b64110d14cefe6c6c8a915f87d6ad

SHA512
5c59670c526178028d52c463f1448e5beadfebb667d53f1f270c1ecab3c09ec47853cb63b120b9561c27d645e9d9663695bc7edbd7fd33a580841aed73223173

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe

Filesize
468KB

MD5
bb5918725922397a04df981da1f8d787

SHA1
6f332f77a508cd8b35a5e898ed59ede1c7241908

SHA256
ea4145fc6508999f95671a8b709a67c712c14edd649ed32bfc9d2196e4a0cf6a

SHA512
b3b6c5bbce796fb0c11700f5edd600cb5db400715d821c58723e966dfe1f348d3b08a16ca000e21b5ec0b8b108933c4075fb006e71f18a30a57eda9dc1dbb179

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe

Filesize
468KB

MD5
a9996e547fcc07e76ab87007d32911ee

SHA1
a4bdb8bd1a379c7523005fd75a8b6426c5d4de87

SHA256
1270004522c51a43a1ba663ca3ed716a2b243b97399098b5cf6db08c1d578b15

SHA512
730688ef410dbf1607d19333d7b94eb306aefea1040c940a1b800e8c672b253b743bd884653fdadbb52732f930f24a28b2f525921d4a0882130e78c162b9b83f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46533.exe

Filesize
468KB

MD5
3e5887ce0051a64f172afd7218ca8261

SHA1
69a2b215af02a3640fa07d733d5ed5abaa3d6e9f

SHA256
52caf0891311d88277e040057e040e28046c6949ccb6b26aabcf80fcaee3b33a

SHA512
c16d5c4c8c260e3267d07fa3cad83391e31a03541d26fb130c20a91418cf1e57881d47157b28fda7105ade74889b2cadcf3bff9d64e75a7cd816d5b5eca1034e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53732.exe

Filesize
468KB

MD5
15220bfd2bc97a94a6b0d5cff5bab1d7

SHA1
7f6e7a0acdbc071c6b4a9ba13fffdecf76822931

SHA256
e4444899a2754207712fc96991974afae85367fa6ac19c2a0aa8af47f077d18e

SHA512
be059a9b5b1ae46c16730b951f58e87ce5846ae31d4a93493c5a766b27923ff88a4a2737ad27ad79284597222879717ba5529aac2b5c1f86a88a672b3e24ef9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5470.exe

Filesize
468KB

MD5
de04d7c09e4fe0fba6396ff21545249b

SHA1
609070196339b1f242c0913a2866e5a309e5f21e

SHA256
0ad3fc6ddc67ca72303557b07ebed161aff414583a5cab07be630b6209f88870

SHA512
d66538d94f33d9cd80c105ff3855452684fbbc5ce365310485032bfe646abb5bba7796424340a0e7513f21b8efa3e8cbfaefbd7017598942c2011969fdf104c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe

Filesize
468KB

MD5
ab8ca9c58f03110e7f6196c6d41dd336

SHA1
df9eab9cc8f0c81ceb6634999dd9663bafc39ec0

SHA256
c2c83fc765bbd7fb4404a2518a7b2494d467063953990d9e541d3175e10d9f73

SHA512
7d6e54e55e7d0d6b0031deb321abbc85817b032e61bfdd75eba528df14bde2a6ac2b02408be852779537d8eb54f70cc1a1430e5db48905c6014261a719f02087

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57871.exe

Filesize
468KB

MD5
8639fc4f1468bc94f4f8148a2ccf9986

SHA1
814c97480e9b38cded9f79d1edeb23164476c805

SHA256
ee64ee523a9c3121c3fc9bb538938ca9f3b40419dc6deeb2fb1aa8c03a3a5908

SHA512
8c73aed9ca3788a01d392def913dd802daa57e305d867d240f584bf6e09ae0bb48293447002d971bf38651f67f8e2e9e89aa1c5def413b6be8f198f1dd61fae1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58999.exe

Filesize
468KB

MD5
efe33935e6385094407e032dc606b347

SHA1
dde6211b9169413acb78f11e4c53f26094c6f96e

SHA256
3f83cbb6c7a0a02c9660626046f0493f3e034b5716d29eebb964d241992e32da

SHA512
6bb0e6b4d388ce397986ecfaeb47551d8a5e879cb9577618e28b1083aaa8e91dc2c693fed24ae0e63cb3800a10dadaf15fa60e3913ad5daa54ddf847b5542498

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62035.exe

Filesize
468KB

MD5
b16ef23ce090ba7111ef0d1c3c8252d5

SHA1
75d426ae6388f462fc94290012bbd439eb6ec48b

SHA256
bcfff5cb50299be7552803c58cabb4d85347f7fd819f2b67d0806357026b3ef3

SHA512
63d6328772ae821690ee67179220605200e9e3bed8c0025432de0f4e628b39078508bf9da6eb26c2eaa23789b6b9dda3904991adde77958a9461a94d45c46cb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe

Filesize
468KB

MD5
c39a172fa3e8487f7c29c6606a4f6f51

SHA1
3d3abbd176c8df940b04c3cfbdfa68f3c03b76b6

SHA256
b1835f0b0784f95c5c4df10f2afd3bef6043f40f41a3611efcf471ca6ee52e16

SHA512
d25b01f86f54aee5979a0dbc9f801b9f9a4621eeafebbe24587fbadc208c0c27e8ba4ef47ae360b893524be99627558e838b1f6243021323f8a862bb61d7291f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe

Filesize
468KB

MD5
0fedf2d4f724285a45a5118926517e30

SHA1
1b77a54b484b8ca1ba98442349765aaf3f859b7d

SHA256
c420c2c3d5e7431b2937fb9d0dfe3d6aa83e545a260ed202cab14b7461c74e2f

SHA512
22f76f281495c2e6c9a553f8d12740aa1277fa1ad58946c17b5a0e1c344eac80f892a9a9a4a857e1ed9beca4b261e118b72fdf28b5bf427ace9dcfa68f993daf

Download Submit
memory/744-3180-0x00007FFF16800000-0x00007FFF16859000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads