a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe
Size

468KB
MD5

cf2e10f7a8b3d0ea0320bd3d1ea0c61d
SHA1

e36129081caa7a327a9350c2f6bf4ea14d3084f0
SHA256

a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9
SHA512

bb381a0e991c67b575de8e374adb611f72c69449d214b6e77d9a2ca7963629d3a97e0b9c109bc6df1fd985ad49d266a396561097e5488c22c83641e28d7e5a8b
SSDEEP

3072:MUyUoAOdI0hUtbYJPzt6fm8/w9pS1IplAmHeRVw+ozXAjS1uEZlR:MUNo2kUtOPJ6fm408jozQG1uE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4980	Unicorn-10504.exe
1628	Unicorn-28681.exe
2744	Unicorn-26412.exe
2164	Unicorn-8712.exe
3080	Unicorn-21903.exe
640	Unicorn-41769.exe
1220	Unicorn-35639.exe
4988	Unicorn-23947.exe
5072	Unicorn-39083.exe
1676	Unicorn-26661.exe
4152	Unicorn-59452.exe
4236	Unicorn-60843.exe
760	Unicorn-60843.exe
2944	Unicorn-54905.exe
4792	Unicorn-41169.exe
4080	Unicorn-51176.exe
436	Unicorn-27832.exe
2428	Unicorn-1674.exe
1720	Unicorn-16392.exe
1048	Unicorn-62255.exe
4356	Unicorn-12561.exe
3180	Unicorn-138.exe
2536	Unicorn-35141.exe
5100	Unicorn-36267.exe
1728	Unicorn-36194.exe
4824	Unicorn-21192.exe
224	Unicorn-63795.exe
3892	Unicorn-4388.exe
892	Unicorn-60995.exe
4016	Unicorn-50060.exe
2548	Unicorn-50060.exe
4212	Unicorn-39851.exe
2216	Unicorn-57832.exe
3804	Unicorn-5486.exe
4388	Unicorn-44459.exe
2524	Unicorn-29384.exe
3932	Unicorn-56310.exe
4612	Unicorn-42574.exe
3588	Unicorn-14619.exe
3284	Unicorn-36203.exe
2608	Unicorn-13841.exe
628	Unicorn-33707.exe
2520	Unicorn-18632.exe
3124	Unicorn-14609.exe
1936	Unicorn-34475.exe
4364	Unicorn-64879.exe
2876	Unicorn-19400.exe
4684	Unicorn-52456.exe
2236	Unicorn-38315.exe
816	Unicorn-38507.exe
1400	Unicorn-53644.exe
1564	Unicorn-38507.exe
4580	Unicorn-41029.exe
752	Unicorn-41029.exe
4412	Unicorn-30344.exe
4740	Unicorn-33144.exe
4548	Unicorn-17877.exe
2684	Unicorn-23743.exe
5052	Unicorn-64079.exe
932	Unicorn-664.exe
3672	Unicorn-52466.exe
4716	Unicorn-26027.exe
2928	Unicorn-40177.exe
2704	Unicorn-60043.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
8760	7124	WerFault.exe	277
4300	4340	WerFault.exe	170
11944	6824	WerFault.exe	262
17380	13536	WerFault.exe	693
18820	10256	Process not Found	1136
18832	15376	Process not Found	1139

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47586.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	11508	Process not Found
Token: SeChangeNotifyPrivilege	11508	Process not Found
Token: 33	11508	Process not Found
Token: SeIncBasePriorityPrivilege	11508	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1584	a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe
4980	Unicorn-10504.exe
1628	Unicorn-28681.exe
2744	Unicorn-26412.exe
2164	Unicorn-8712.exe
1220	Unicorn-35639.exe
3080	Unicorn-21903.exe
640	Unicorn-41769.exe
4988	Unicorn-23947.exe
5072	Unicorn-39083.exe
1676	Unicorn-26661.exe
2944	Unicorn-54905.exe
4152	Unicorn-59452.exe
760	Unicorn-60843.exe
4236	Unicorn-60843.exe
4792	Unicorn-41169.exe
4080	Unicorn-51176.exe
436	Unicorn-27832.exe
1720	Unicorn-16392.exe
2428	Unicorn-1674.exe
1048	Unicorn-62255.exe
2536	Unicorn-35141.exe
4356	Unicorn-12561.exe
1728	Unicorn-36194.exe
3180	Unicorn-138.exe
4824	Unicorn-21192.exe
3892	Unicorn-4388.exe
224	Unicorn-63795.exe
892	Unicorn-60995.exe
4016	Unicorn-50060.exe
5100	Unicorn-36267.exe
2548	Unicorn-50060.exe
4212	Unicorn-39851.exe
2216	Unicorn-57832.exe
3804	Unicorn-5486.exe
2524	Unicorn-29384.exe
3932	Unicorn-56310.exe
4612	Unicorn-42574.exe
4388	Unicorn-44459.exe
3588	Unicorn-14619.exe
3284	Unicorn-36203.exe
628	Unicorn-33707.exe
2608	Unicorn-13841.exe
2520	Unicorn-18632.exe
1936	Unicorn-34475.exe
4684	Unicorn-52456.exe
4364	Unicorn-64879.exe
3124	Unicorn-14609.exe
2876	Unicorn-19400.exe
4412	Unicorn-30344.exe
2236	Unicorn-38315.exe
4740	Unicorn-33144.exe
4580	Unicorn-41029.exe
4548	Unicorn-17877.exe
5052	Unicorn-64079.exe
816	Unicorn-38507.exe
752	Unicorn-41029.exe
1400	Unicorn-53644.exe
2684	Unicorn-23743.exe
3672	Unicorn-52466.exe
932	Unicorn-664.exe
1564	Unicorn-38507.exe
4716	Unicorn-26027.exe
2028	Unicorn-24491.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 4980	1584	a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe	86
PID 1584 wrote to memory of 4980	1584	a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe	86
PID 1584 wrote to memory of 4980	1584	a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe	86
PID 4980 wrote to memory of 1628	4980	Unicorn-10504.exe	87
PID 4980 wrote to memory of 1628	4980	Unicorn-10504.exe	87
PID 4980 wrote to memory of 1628	4980	Unicorn-10504.exe	87
PID 1584 wrote to memory of 2744	1584	a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe	88
PID 1584 wrote to memory of 2744	1584	a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe	88
PID 1584 wrote to memory of 2744	1584	a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe	88
PID 1628 wrote to memory of 2164	1628	Unicorn-28681.exe	89
PID 1628 wrote to memory of 2164	1628	Unicorn-28681.exe	89
PID 1628 wrote to memory of 2164	1628	Unicorn-28681.exe	89
PID 4980 wrote to memory of 3080	4980	Unicorn-10504.exe	90
PID 4980 wrote to memory of 3080	4980	Unicorn-10504.exe	90
PID 4980 wrote to memory of 3080	4980	Unicorn-10504.exe	90
PID 2744 wrote to memory of 640	2744	Unicorn-26412.exe	91
PID 2744 wrote to memory of 640	2744	Unicorn-26412.exe	91
PID 2744 wrote to memory of 640	2744	Unicorn-26412.exe	91
PID 1584 wrote to memory of 1220	1584	a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe	92
PID 1584 wrote to memory of 1220	1584	a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe	92
PID 1584 wrote to memory of 1220	1584	a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe	92
PID 2164 wrote to memory of 4988	2164	Unicorn-8712.exe	93
PID 2164 wrote to memory of 4988	2164	Unicorn-8712.exe	93
PID 2164 wrote to memory of 4988	2164	Unicorn-8712.exe	93
PID 1628 wrote to memory of 5072	1628	Unicorn-28681.exe	94
PID 1628 wrote to memory of 5072	1628	Unicorn-28681.exe	94
PID 1628 wrote to memory of 5072	1628	Unicorn-28681.exe	94
PID 1220 wrote to memory of 1676	1220	Unicorn-35639.exe	95
PID 1220 wrote to memory of 1676	1220	Unicorn-35639.exe	95
PID 1220 wrote to memory of 1676	1220	Unicorn-35639.exe	95
PID 1584 wrote to memory of 4152	1584	a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe	96
PID 1584 wrote to memory of 4152	1584	a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe	96
PID 1584 wrote to memory of 4152	1584	a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe	96
PID 640 wrote to memory of 4236	640	Unicorn-41769.exe	97
PID 640 wrote to memory of 4236	640	Unicorn-41769.exe	97
PID 640 wrote to memory of 4236	640	Unicorn-41769.exe	97
PID 3080 wrote to memory of 760	3080	Unicorn-21903.exe	98
PID 3080 wrote to memory of 760	3080	Unicorn-21903.exe	98
PID 3080 wrote to memory of 760	3080	Unicorn-21903.exe	98
PID 4980 wrote to memory of 2944	4980	Unicorn-10504.exe	99
PID 4980 wrote to memory of 2944	4980	Unicorn-10504.exe	99
PID 4980 wrote to memory of 2944	4980	Unicorn-10504.exe	99
PID 2744 wrote to memory of 4792	2744	Unicorn-26412.exe	100
PID 2744 wrote to memory of 4792	2744	Unicorn-26412.exe	100
PID 2744 wrote to memory of 4792	2744	Unicorn-26412.exe	100
PID 5072 wrote to memory of 4080	5072	Unicorn-39083.exe	101
PID 5072 wrote to memory of 4080	5072	Unicorn-39083.exe	101
PID 5072 wrote to memory of 4080	5072	Unicorn-39083.exe	101
PID 1628 wrote to memory of 436	1628	Unicorn-28681.exe	102
PID 1628 wrote to memory of 436	1628	Unicorn-28681.exe	102
PID 1628 wrote to memory of 436	1628	Unicorn-28681.exe	102
PID 4988 wrote to memory of 2428	4988	Unicorn-23947.exe	103
PID 4988 wrote to memory of 2428	4988	Unicorn-23947.exe	103
PID 4988 wrote to memory of 2428	4988	Unicorn-23947.exe	103
PID 1676 wrote to memory of 1720	1676	Unicorn-26661.exe	104
PID 1676 wrote to memory of 1720	1676	Unicorn-26661.exe	104
PID 1676 wrote to memory of 1720	1676	Unicorn-26661.exe	104
PID 1220 wrote to memory of 1048	1220	Unicorn-35639.exe	105
PID 1220 wrote to memory of 1048	1220	Unicorn-35639.exe	105
PID 1220 wrote to memory of 1048	1220	Unicorn-35639.exe	105
PID 2164 wrote to memory of 4356	2164	Unicorn-8712.exe	106
PID 2164 wrote to memory of 4356	2164	Unicorn-8712.exe	106
PID 2164 wrote to memory of 4356	2164	Unicorn-8712.exe	106
PID 2944 wrote to memory of 3180	2944	Unicorn-54905.exe	107

C:\Users\Admin\AppData\Local\Temp\a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe
"C:\Users\Admin\AppData\Local\Temp\a622f8b715004755379065a9480767c25a5e49642343f21f9b43dafcc9175bc9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10504.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10504.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28681.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23947.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18632.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60360.exe
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16965.exe
        9⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61762.exe
        10⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
        10⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51113.exe
        9⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        9⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        9⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        8⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        9⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        9⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25016.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47401.exe
        8⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25582.exe
        8⤵
        
        PID:17656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe
        8⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        8⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10165.exe
        8⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        8⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
        7⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        7⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        8⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        9⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
        10⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5249.exe
        10⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38024.exe
        9⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57014.exe
        9⤵
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
        9⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        8⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43670.exe
        8⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        8⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        8⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56399.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9482.exe
        8⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        8⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13151.exe
        7⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1509.exe
        7⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34354.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58024.exe
        8⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        8⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20200.exe
        8⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        7⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        7⤵
        
        PID:17740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        7⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24194.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37611.exe
        7⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        7⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
        7⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
        6⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        6⤵
        
        PID:18016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
        6⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12561.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52456.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
        7⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28392.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        9⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19672.exe
        9⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48591.exe
        9⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe
        8⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11496.exe
        8⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe
        8⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exe
        7⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45736.exe
        8⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exe
        8⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
        8⤵
        
        PID:17384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        7⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
        7⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
        7⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        8⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        8⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        8⤵
        
        PID:17976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        7⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        7⤵
        
        PID:13536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13536 -s 436
        8⤵
        Program crash
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59843.exe
        7⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-417.exe
        7⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        6⤵
        
        PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17877.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        6⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        8⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26673.exe
        8⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        8⤵
        
        PID:17988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        8⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        7⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        7⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59843.exe
        7⤵
        
        PID:18152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        7⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        6⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7975.exe
        6⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15714.exe
        5⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41899.exe
        6⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        6⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        6⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
        6⤵
        
        PID:10236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31342.exe
        5⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16808.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe
        6⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25048.exe
        5⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        5⤵
        
        PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
        8⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43659.exe
        9⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        10⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
        10⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
        10⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        9⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        9⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        9⤵
        
        PID:16748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46841.exe
        9⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        9⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3779.exe
        9⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe
        8⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        8⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36870.exe
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4174.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        8⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
        9⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        9⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23272.exe
        9⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12369.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exe
        8⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50585.exe
        8⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55100.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        7⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        7⤵
        
        PID:15332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        6⤵
        Executes dropped EXE
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        8⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18926.exe
        8⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
        8⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe
        7⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36176.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        7⤵
        
        PID:15160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        6⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53775.exe
        7⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16565.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        7⤵
        
        PID:16980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        7⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43580.exe
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        6⤵
        
        PID:11644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        6⤵
        
        PID:14844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
        6⤵
        Executes dropped EXE
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52680.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
        8⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        8⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42736.exe
        8⤵
        
        PID:17160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        8⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
        7⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
        8⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43039.exe
        8⤵
        
        PID:17776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
        7⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        7⤵
        
        PID:16784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
        7⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        7⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45670.exe
        7⤵
        
        PID:18104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
        6⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62528.exe
        6⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        6⤵
        
        PID:17492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        5⤵
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        6⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        7⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        8⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        8⤵
        
        PID:14424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
        8⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exe
        7⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30773.exe
        7⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21643.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28533.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        6⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        6⤵
        
        PID:17784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55365.exe
        6⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12504.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32463.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
        5⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65138.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35611.exe
        5⤵
        
        PID:15052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27832.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        6⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        8⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        8⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        8⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52214.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30574.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47286.exe
        7⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe
        7⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51567.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51769.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9941.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37983.exe
        6⤵
        
        PID:12328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35080.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
        6⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
        5⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28485.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12577.exe
        7⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        7⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        7⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27819.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4074.exe
        7⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
        7⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        6⤵
        
        PID:13280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        6⤵
        
        PID:16808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
        6⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16885.exe
        5⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33771.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
        6⤵
        
        PID:13560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38896.exe
        6⤵
        
        PID:18108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        6⤵
        
        PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3886.exe
        5⤵
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39698.exe
        5⤵
        
        PID:18424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44535.exe
        5⤵
        
        PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15274.exe
        5⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
        6⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        7⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53388.exe
        6⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38480.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
        6⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        6⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3150.exe
        5⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42344.exe
        6⤵
        
        PID:10992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57359.exe
        6⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38674.exe
        6⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54367.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        5⤵
        
        PID:17928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        5⤵
        
        PID:17644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
      4⤵
      PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54632.exe
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12920.exe
        6⤵
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
        5⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45097.exe
        5⤵
        
        PID:13668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        5⤵
        
        PID:17488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63087.exe
      4⤵
      PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1290.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        5⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        5⤵
        
        PID:18004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36988.exe
        5⤵
        
        PID:17880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        5⤵
        
        PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64472.exe
      4⤵
      PID:8628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
      4⤵
      PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32585.exe
      4⤵
      PID:17088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21903.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
        8⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        9⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        9⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
        9⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        9⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
        8⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51977.exe
        8⤵
        
        PID:14828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29633.exe
        8⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1631.exe
        7⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        7⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22923.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
        7⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
        8⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21535.exe
        8⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        7⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18334.exe
        7⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10209.exe
        7⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        6⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45803.exe
        7⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        7⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        7⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        6⤵
        
        PID:10396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
        6⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
        6⤵
        
        PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47769.exe
        5⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        6⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59339.exe
        7⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        7⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        7⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59343.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8309.exe
        6⤵
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        6⤵
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10462.exe
        5⤵
        
        PID:7124
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7124 -s 488
        6⤵
        Program crash
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13681.exe
        5⤵
        
        PID:14536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
        5⤵
        
        PID:8076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19400.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        6⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19944.exe
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
        8⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39438.exe
        8⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47273.exe
        7⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        7⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60287.exe
        7⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        6⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48833.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20977.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37611.exe
        7⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        7⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        7⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25180.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
        5⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50600.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        6⤵
        
        PID:13820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        6⤵
        
        PID:17964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
        6⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        5⤵
        
        PID:17940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33144.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        5⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe
        7⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18926.exe
        7⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
        7⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        6⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
        6⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exe
        5⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        6⤵
        
        PID:14808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        6⤵
        
        PID:18420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62425.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        5⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45987.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        5⤵
        
        PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
      4⤵
      PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
        5⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40360.exe
        5⤵
        
        PID:9484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        5⤵
        
        PID:14660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        5⤵
        
        PID:8172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50726.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        5⤵
        
        PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32049.exe
        5⤵
        
        PID:13056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7951.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
      4⤵
      PID:9988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
      4⤵
      PID:13828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48343.exe
      4⤵
      PID:18052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
      4⤵
      PID:9640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54905.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        6⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37483.exe
        8⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        8⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        8⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
        7⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        7⤵
        
        PID:16816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
        7⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42951.exe
        7⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1205.exe
        6⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5656.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45408.exe
        6⤵
        
        PID:17496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe
        5⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        7⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        7⤵
        
        PID:16792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
        6⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1583.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17139.exe
        6⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11602.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65449.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44050.exe
        6⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        5⤵
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        5⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        5⤵
        
        PID:18180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29416.exe
        5⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2154.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52971.exe
        7⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 752
        7⤵
        Program crash
        
        PID:11944
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 636
        6⤵
        Program crash
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        5⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12967.exe
        6⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5057.exe
        6⤵
        
        PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        5⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        5⤵
        
        PID:14512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        5⤵
        
        PID:8220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57878.exe
      4⤵
      PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48677.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37483.exe
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        6⤵
        
        PID:16764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
        5⤵
        
        PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        5⤵
        
        PID:18180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
      4⤵
      PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
        5⤵
        
        PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
      4⤵
      PID:9252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27793.exe
      4⤵
      PID:13628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
      4⤵
      PID:17780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
      4⤵
      PID:2500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38507.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3946.exe
        5⤵
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41899.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        7⤵
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        6⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
        6⤵
        
        PID:15916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12746.exe
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        6⤵
        
        PID:16044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        5⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
        5⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        5⤵
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54444.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        6⤵
        
        PID:14208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        6⤵
        
        PID:18412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        6⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        5⤵
        
        PID:10676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        5⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
        5⤵
        
        PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46201.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2216.exe
        5⤵
        
        PID:14632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38482.exe
        5⤵
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
      4⤵
      PID:9788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
      4⤵
      PID:13520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19560.exe
      4⤵
      PID:17816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-519.exe
        5⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5223.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51593.exe
        6⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52627.exe
        6⤵
        
        PID:18256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21025.exe
        6⤵
        
        PID:17948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        5⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        5⤵
        
        PID:12944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        5⤵
        
        PID:16904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8075.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
        5⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61570.exe
        5⤵
        
        PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
      4⤵
      PID:9228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13151.exe
      4⤵
      PID:14652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe
      4⤵
      PID:6580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
    3⤵
    PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        5⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        6⤵
        
        PID:16604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        5⤵
        
        PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
      4⤵
      PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57904.exe
      4⤵
      PID:12476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
      4⤵
      PID:16884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1178.exe
    3⤵
    PID:7792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12413.exe
    3⤵
    PID:10840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2057.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10697.exe
    3⤵
    PID:17664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26412.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26412.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41769.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
        6⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        8⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
        9⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        9⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
        9⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14248.exe
        8⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
        8⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        8⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10919.exe
        8⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        7⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-296.exe
        7⤵
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        6⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        7⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58024.exe
        8⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        8⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        8⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20440.exe
        7⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        7⤵
        
        PID:18372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        7⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65084.exe
        6⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52934.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        6⤵
        
        PID:15432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
        6⤵
        
        PID:18132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52466.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        6⤵
        
        PID:528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49035.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58984.exe
        8⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18926.exe
        8⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
        8⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        7⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43670.exe
        7⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12225.exe
        7⤵
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10040.exe
        7⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27950.exe
        6⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60738.exe
        7⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        7⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55561.exe
        7⤵
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        6⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        6⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        5⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22923.exe
        6⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        7⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
        7⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        7⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48498.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29007.exe
        6⤵
        
        PID:13448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54652.exe
        6⤵
        
        PID:17476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
        6⤵
        
        PID:16600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3937.exe
        5⤵
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60736.exe
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45614.exe
        5⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45605.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        8⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        8⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
        8⤵
        
        PID:18076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61762.exe
        8⤵
        
        PID:17928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe
        7⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11496.exe
        7⤵
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
        7⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
        6⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        7⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44271.exe
        7⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        7⤵
        
        PID:17996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        7⤵
        
        PID:17852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53186.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
        6⤵
        
        PID:17800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31211.exe
        6⤵
        
        PID:15148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16104.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        7⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        7⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
        7⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23121.exe
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        6⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        6⤵
        
        PID:17732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27669.exe
        5⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12746.exe
        6⤵
        
        PID:10544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        6⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28392.exe
        5⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        5⤵
        
        PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-664.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        5⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42891.exe
        6⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        7⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        7⤵
        
        PID:17732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29935.exe
        7⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        6⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32079.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        6⤵
        
        PID:16660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22382.exe
        5⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48808.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        6⤵
        
        PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        5⤵
        
        PID:13888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        5⤵
        
        PID:18168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10043.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        6⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        6⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        5⤵
        
        PID:10660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        5⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59843.exe
        5⤵
        
        PID:18320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        5⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
      4⤵
      PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        5⤵
        
        PID:14820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62601.exe
        5⤵
        
        PID:17972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
      4⤵
      PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45051.exe
      4⤵
      PID:13548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15095.exe
      4⤵
      PID:17772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60354.exe
      4⤵
      PID:3868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4388.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34475.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60360.exe
        6⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
        8⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18526.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59843.exe
        7⤵
        
        PID:18204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        7⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57004.exe
        6⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        6⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54911.exe
        6⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48658.exe
        5⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        6⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        6⤵
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
        6⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22946.exe
        6⤵
        
        PID:18012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        5⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exe
        6⤵
        
        PID:13752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31077.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33849.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4293.exe
        5⤵
        
        PID:15148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62130.exe
        5⤵
        
        PID:532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61762.exe
        6⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38896.exe
        6⤵
        
        PID:17828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        6⤵
        
        PID:17760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
        5⤵
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        6⤵
        
        PID:13960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62601.exe
        6⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53250.exe
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35080.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
        5⤵
        
        PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4178.exe
      4⤵
      PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exe
        5⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exe
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
        6⤵
        
        PID:13436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48787.exe
        6⤵
        
        PID:17560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40360.exe
        5⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        5⤵
        
        PID:14580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13473.exe
        5⤵
        
        PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
      4⤵
      PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12862.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33413.exe
      4⤵
      PID:10880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
      4⤵
      PID:14432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
      4⤵
      PID:17580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63795.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38507.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        5⤵
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        6⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        6⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        6⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
        5⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54251.exe
        6⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        6⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
        5⤵
        
        PID:14372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        5⤵
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
      4⤵
      PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32235.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16952.exe
        6⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50585.exe
        6⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
        5⤵
        
        PID:15196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
        5⤵
        
        PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55100.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
      4⤵
      PID:11756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
      4⤵
      PID:15520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
      4⤵
      PID:10460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42635.exe
      4⤵
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
        5⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
        5⤵
        
        PID:11328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25368.exe
        5⤵
        
        PID:15680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23314.exe
        5⤵
        
        PID:8524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8498.exe
      4⤵
      PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe
      4⤵
      PID:12176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50374.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
      4⤵
      PID:9264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
    3⤵
    PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
      4⤵
      PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29896.exe
        5⤵
        
        PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        5⤵
        
        PID:13216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
        5⤵
        
        PID:17092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9745.exe
      4⤵
      PID:8768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32335.exe
      4⤵
      PID:12400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51551.exe
      4⤵
      PID:15380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
      4⤵
      PID:9804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29745.exe
    3⤵
    PID:7252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61762.exe
      4⤵
      PID:9824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
      4⤵
      PID:13504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
      4⤵
      PID:7136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
    3⤵
    PID:8660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
    3⤵
    PID:13948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
    3⤵
    PID:17912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24705.exe
    3⤵
    PID:1576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16392.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29384.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9415.exe
        6⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        8⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        8⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43958.exe
        8⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18705.exe
        8⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45391.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23199.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        7⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9169.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55819.exe
        7⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        7⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14952.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exe
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50374.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11556.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe
        7⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        7⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        7⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
        6⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45097.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14384.exe
        6⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
        6⤵
        
        PID:13224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        6⤵
        
        PID:16860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
        6⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34364.exe
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29535.exe
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41809.exe
        5⤵
        
        PID:17516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
        5⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29035.exe
        6⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59339.exe
        7⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        7⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
        7⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        6⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63404.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        6⤵
        
        PID:15672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47449.exe
        6⤵
        
        PID:17712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
        5⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23016.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2666.exe
        5⤵
        
        PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9144.exe
      4⤵
      PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30021.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
        6⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
        6⤵
        
        PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        5⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45273.exe
        5⤵
        
        PID:12372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52127.exe
        5⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        5⤵
        
        PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
      4⤵
      PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        5⤵
        
        PID:13160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        5⤵
        
        PID:16616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12648.exe
        5⤵
        
        PID:10184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
      4⤵
      PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45992.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45938.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24491.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48072.exe
        6⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21026.exe
        8⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        8⤵
        
        PID:18032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52214.exe
        8⤵
        
        PID:17844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        7⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25410.exe
        7⤵
        
        PID:17860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        7⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        6⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27816.exe
        7⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        6⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12535.exe
        7⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        6⤵
        
        PID:14472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13473.exe
        6⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        6⤵
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
        6⤵
        
        PID:17896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        6⤵
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        5⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48773.exe
        6⤵
        
        PID:18136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        6⤵
        
        PID:18364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42041.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35080.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe
        5⤵
        
        PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
      4⤵
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52488.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27819.exe
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38070.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
        6⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        6⤵
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27601.exe
        5⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15864.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        5⤵
        
        PID:15068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        5⤵
        
        PID:10360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
      4⤵
      PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11556.exe
        5⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4711.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36913.exe
        5⤵
        
        PID:11924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        5⤵
        
        PID:15660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe
      4⤵
      PID:7884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18440.exe
      4⤵
      PID:12212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33838.exe
      4⤵
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
      4⤵
      PID:9340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10183.exe
      4⤵
      PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1450.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
        6⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15919.exe
        6⤵
        
        PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
        5⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
        5⤵
        
        PID:11636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        5⤵
        
        PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46546.exe
      4⤵
      PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60520.exe
        5⤵
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        5⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        5⤵
        
        PID:17884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29992.exe
      4⤵
      PID:13272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
      4⤵
      PID:16772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
      4⤵
      PID:5304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
    3⤵
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exe
      4⤵
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        5⤵
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39793.exe
        5⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        5⤵
        
        PID:15000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18513.exe
        5⤵
        
        PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52978.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14328.exe
      4⤵
      PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
      4⤵
      PID:17364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14085.exe
    3⤵
    PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
      4⤵
      PID:14984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38185.exe
      4⤵
      PID:6424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
    3⤵
    PID:7292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63058.exe
    3⤵
    PID:11956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
    3⤵
    PID:3780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21829.exe
        5⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57032.exe
        6⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe
        7⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
        7⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20728.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26783.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
        6⤵
        
        PID:17576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        6⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42731.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        6⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
        6⤵
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe
        5⤵
        
        PID:9744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        5⤵
        
        PID:14752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36870.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8782.exe
      4⤵
      PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2823.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53314.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34161.exe
        6⤵
        
        PID:13676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35384.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
        5⤵
        
        PID:12688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52127.exe
        5⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58390.exe
      4⤵
      PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65256.exe
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22440.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        5⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
        5⤵
        
        PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14846.exe
      4⤵
      PID:8860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54336.exe
      4⤵
      PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
      4⤵
      PID:16752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
      4⤵
      PID:10156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
      4⤵
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
        5⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37611.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        6⤵
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        6⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        5⤵
        
        PID:14680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10209.exe
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
      4⤵
      PID:7480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
      4⤵
      PID:10816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
      4⤵
      PID:15580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
      4⤵
      PID:3388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4178.exe
    3⤵
    PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33800.exe
      4⤵
      PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
        5⤵
        
        PID:17108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
      4⤵
      PID:10824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31192.exe
      4⤵
      PID:14384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44991.exe
    3⤵
    PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2538.exe
      4⤵
      PID:14604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
      4⤵
      PID:3968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
    3⤵
    PID:12140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
    3⤵
    PID:316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
    3⤵
    PID:6368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe
      4⤵
      PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45704.exe
        5⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48306.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exe
        5⤵
        
        PID:18304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61279.exe
      4⤵
      PID:8780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28511.exe
      4⤵
      PID:13300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62121.exe
      4⤵
      PID:16624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50150.exe
      4⤵
      PID:9772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
    3⤵
    PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43976.exe
      4⤵
      PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
        5⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36913.exe
        5⤵
        
        PID:11936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        5⤵
        
        PID:15104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18513.exe
        5⤵
        
        PID:9852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
      4⤵
      PID:8612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
      4⤵
      PID:12316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64514.exe
      4⤵
      PID:17344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17139.exe
      4⤵
      PID:10476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3448.exe
    3⤵
    PID:7784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
    3⤵
    PID:10856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47936.exe
    3⤵
    PID:14800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
    3⤵
    PID:18368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47467.exe
    3⤵
    PID:18256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
    3⤵
    PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
      4⤵
      PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        5⤵
        
        PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        5⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        5⤵
        
        PID:18024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        5⤵
        
        PID:14808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14673.exe
      4⤵
      PID:9964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40217.exe
      4⤵
      PID:13964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
      4⤵
      PID:17952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
      4⤵
      PID:6396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53932.exe
    3⤵
    PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40360.exe
      4⤵
      PID:11860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
      4⤵
      PID:15668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14952.exe
      4⤵
      PID:9436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
    3⤵
    PID:9376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
    3⤵
    PID:15188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26102.exe
    3⤵
    PID:4804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
  2⤵
  PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28709.exe
    3⤵
    PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
      4⤵
      PID:9296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13151.exe
      4⤵
      PID:14688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
      4⤵
      PID:11440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
    3⤵
    PID:8804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45849.exe
    3⤵
    PID:12420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
    3⤵
    PID:16840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13472.exe
  2⤵
  PID:7936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22351.exe
    3⤵
    PID:13176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
    3⤵
    PID:9976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
  2⤵
  PID:11084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
  2⤵
  PID:15044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
  2⤵
  PID:18392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7124 -ip 7124
1⤵
PID:8588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4340 -ip 4340
1⤵
PID:8512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6824 -ip 6824
1⤵
PID:13236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 13536 -ip 13536
1⤵
PID:17372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10504.exe

Filesize
468KB

MD5
8022faaecd96b134feb503857855d7ee

SHA1
62b9082374a5037578d18adeda7fbbb0b153494c

SHA256
e341b5eecafe0f041749721ceddbe526d172587ae0e44182026b51a855694b87

SHA512
0fa5f48311683a401fc5bf93cd037e7e252891563ffa2a9849d442f3322f6d5c067e8c725e990670de57113200beb7e385e18c9aacc10053452ad36af8217c48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12561.exe

Filesize
468KB

MD5
eced2fa57ef298d003cb9f698e6fb96f

SHA1
7913d202ad31a3ba52481da64717531d12f95083

SHA256
a30a0dd19ebcf470b1bb04223bfb0976dee9932f78ffbaeaf8d70ffb442b47ce

SHA512
8d2a63a1e7ae8f7ad7617f85ad5d3f5ad5d74213a26e2e35aca3e49ce08c42f6166933ef8562a5e9a59ba49c42ec105b77fd894d832b2ed287571ea430cef117

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe

Filesize
468KB

MD5
2928f21b04f48e9578346d0c50dc6900

SHA1
85d68443c015f3b2ec0af9ea97317c8563057a41

SHA256
1ab260eb9a2fea853700a0b51183c4f694bf59ed6fa47283eabce8c23d47f176

SHA512
beddb839596a1f917a356d4dc42c082676c88b64fe1db80760dfaea4ee9d2127207ba157374ad9ee1b774a2a5418b8258fd067d08f3556125457af1ba174ebd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16392.exe

Filesize
468KB

MD5
1937d1a0d8d3ed08d1ed2682cf17e7d8

SHA1
ddc472b0e0275691b629b7c8d6c21f0363083ab1

SHA256
21d808bcf062c3433732e67eb19d4eab930fe56275ba5bfa9b78fae7de180556

SHA512
269665ba850cadcea11a15b61396d3d5cd19a346bbb0dcc977046e562766cf8373ef454ff521e8f18c00fce9a694293e9c1165dcceac30f5b793cb9fe718de5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe

Filesize
468KB

MD5
6880b0cca3b8cb949863501b40de74e2

SHA1
40a4fe3b54be38d49fa1b4510d0c3c50f1e8a99a

SHA256
17e5cda806a78a58e06ea826c86db9114333ced7269b3cf39ad3fa6bf576f608

SHA512
52d53a427c5b0101b9515f469888bd08749b88a04fb3485abf4467a85111aed68f971f5b78361eb047d7da0bf25d4001b894739f5081ce5d11eb8b71ae3fc0d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe

Filesize
468KB

MD5
71558e8b74e096d9d2c280020007349b

SHA1
33fc0e3c355e8d6726c143b513327dd38cae5344

SHA256
a1dd03ef49a7ab9a6d6ba4a779a92aa0276e4a31c394f8734e3b4111c225cc3b

SHA512
a6a248da5b4d6aa8df340a3c109c1e4ac8517d714dabf1163aec1586dfc94fd8904d16f0476467e24787c08251d5629cc3b6351173a4410fd2a49cafb0f21b3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21903.exe

Filesize
468KB

MD5
976737fecf425d5dea9b70215a99ec5b

SHA1
39e387fc7dc332bd658391d733addf1a9f4d0b50

SHA256
58423152e709cc988a04c43bceb4ba090844d3071998639f70f412beb48f1b9b

SHA512
64e75e277045e77e0892977adbed814d015dc3e65304d5c1d98957f8032d6f735be8498ecc69fdbcc53cc310066d40bc2eea542ab8e8b94becaff84e77913fa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23947.exe

Filesize
468KB

MD5
c5a2b75233cf32e75b0868868d4de156

SHA1
509fe0bb034f2e1268c6a84fdafc6966d3caa7bd

SHA256
f3c119eaf8bf0b969bd283d280065a778b7f55d6cfb42126f33d987e3b2401cd

SHA512
6aef93413892aa901cafc1987a0668f3913a6207b731b16c3713ee2388c1b1c8d46478889e2edf9bc2d645808d269963e0d92b000b2b251c19699f31ada317f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe

Filesize
468KB

MD5
4659bfdd135fba7461d1535b226e68d3

SHA1
6fb3ac2f439715f4f706eef3e4e59cac84ac0ece

SHA256
d0de3f8cd9fea2b278c1292c8cc17fc1493e35151f66f2c8c42d3db97daf9e1f

SHA512
6ef251f2dcda59fd1624e2d23773b314488f01471133c1689926e3dc9984779d16c37b9385f36b7c9a91191cb4f3c00e9d6b1780718e140f435459630c00d720

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26412.exe

Filesize
468KB

MD5
f1223668a4e39fae10c4a9145dea590a

SHA1
78ed82009faea0ed177dd5972ff7d72da0bb8373

SHA256
65e1ec82246abf464dcbccb80d40a1ba8e8713266ea2086cb972bf97d25e6f25

SHA512
08191052bf327fc2999e30ff214f31b186dbb4448a110a5d1ce2fd75d2f4bd493aa35bd7c02dee4eda54b8c423bc9de2e6defb7a1b91281a8982cfd808aff7cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe

Filesize
468KB

MD5
ed868a18a72da3254b16a6ce61cd94c7

SHA1
038cce0bd857504eab995b936d7819b1f9ee231e

SHA256
db060894655aa85d9f803d34f5b4767ba6c58f131a79f58c47eec63ce595a9e4

SHA512
6137a789be828ffa7c82b4af27ee67c271c570a4e5c3f195534d32c760005760e000712a2e1710f993a93fbd5930ed6f6fcb83e9f8b7b129f491e237672981f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27832.exe

Filesize
468KB

MD5
75d60dca9d1327a776d56c21e862fd28

SHA1
9c2a3016cc2d58113000a5b5a8848279cb8cf11e

SHA256
0f2ae0ace3d7af14b01d353d6f7d20a2ef8290852f0320eb4a5e63c51870dbd9

SHA512
f96f22148a0b861eee2f64a6a13122cdea9113a0a1dde18fae4ee36323ca98635cb9f0d0774b81f1cb328eeed6e4f76d01ee48ee1a9f101a6c7898947142a189

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28681.exe

Filesize
468KB

MD5
ad992cf8e899796561934f09693a30ff

SHA1
3234c49e0a2d970ee4157b4e8216520aa8bd3465

SHA256
b92fb37d95d010b5113498026e898c7c66458a721f70ec1921ad0ad4dc60b009

SHA512
511a6c23e04fcfd5c0e2e9a98e7fe3e94df4bcf1baed318720e6cfe8d441cf297970fe488593fedda05a33479e32037ca7c26f82c2c3288a072be1d7a4f2a203

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe

Filesize
468KB

MD5
b35520b717374d8497003106c954d1aa

SHA1
14b924de251bab9689b13bd49575f77f27a4c350

SHA256
72216f97d59250edc645a034da3c4373a00202c7faaebe63591e7ba12016e0c6

SHA512
15777c8e5c0a26806fd5e156862c8d319fb9168c50c0060e3927ff56c04de3dc1b42e969f8d95d381cbfc15efc1c6cdfdf804448dee6468de0c5854c11d210d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe

Filesize
468KB

MD5
a81ebd5803ec8df822cf101f5006187d

SHA1
d79d974fbd5e5f05eedc7bea1e103d71ba240684

SHA256
6e35f42ee73c9d7c4d816513a963307a82ffff92a855e7d64e4a53b3e8d55f84

SHA512
e604909452104a08ced9880aeceab362cc9e3d2a7bbc09dd016196c95ce4f591d4ff4bf06fbd939d25b72e76e3c918ff3760dc9211bb117f73bb9cd75bcf6362

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe

Filesize
468KB

MD5
c5e85834ec1017a13590eefb596d507c

SHA1
553976f0bb8a7d49fc570864c519f447beb2d79c

SHA256
5f165e9d2915b4026ac9963e5c05dfe264c00c7c3c3bc65c160589e6cb53c3a1

SHA512
75dd85f795f46ad04172b99a396e0a1a08e0eaa54b25ec2279d12a446e658e07568d0e263ec936c00ada5b809032bec4a1c42834d5c37e31fb5d41e7b2dcd604

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe

Filesize
468KB

MD5
ffd1c60825c49d29cda7940a7fd7b8fb

SHA1
b0b0a594fc34ab3c2743dd1f2fa1fff02183e12d

SHA256
3c06772fc41bc69e5b8b39f95c6e61f4256a5d575f512e53c737eb8e8a8b672a

SHA512
86e8f775e0fe40cc13dc80ba37f84efb6c4cbfa7ce0db5ed5fb37725ee9d359e6f390beaed1cfdf1c716987ad592ac37e80c0290defdd1400a8b7a2a845e63c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe

Filesize
468KB

MD5
ed5e8bb70cfd4e06f2e7a1041fd119cd

SHA1
d004d65ad8c5c96285ae03f9226762757622e67d

SHA256
7c45c31989cc34f4f5abcca9915db5024493708faaff323ebc6a88ec0f7421c8

SHA512
fcbdf691e90cc66f205bd6a3dfbbc5111fd3a26a55b86c6c180d05ed3a77ced53dd014e4f01735036a837b15174c9a94cdcce2149cb1e1757bc4ff11c30ac9ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe

Filesize
468KB

MD5
16782edabf3485ce214e363b5de90b22

SHA1
e60c030770a61f24072b0996c95d0650076535e3

SHA256
24c7589031e534fbb3853974eb5cbefdcadb107de90b24362ca353b837173740

SHA512
d48e4e4da9aa33032744f1c4f87243cc008f8bc670cfe29e5fff157ccb0b9c583aab99ac3a1e572a195e3e29e5c4d8af29ddea3c4a9cfb4b614c312d8f8edcb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe

Filesize
468KB

MD5
46c9fb7ed29099215fc60056613a84b1

SHA1
71662263c0c92f498939e04751b1df2caab5bd66

SHA256
9d0ac7ec9684c18c6970c5fdf75058419c25e24fa64381c4b2e2f373a175b172

SHA512
94c7b45ce8d8513b1fa09bbd528090df6b056f54e079473a88d70698ec17fdbfca122210295f11ed8cacc5a0c2b650a265129c5cabeb4d5cb1922cc850c8fb4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41769.exe

Filesize
468KB

MD5
3bba942b8172bdbd29bb55540bdb822e

SHA1
64c143a3d3cc8c3a1c0e1f3082dbb68746f01a34

SHA256
4c145f1dfb1ef8d1ad421b227d008268987254d4ce1a6bed1794e2c7f538ac2d

SHA512
2e67f73eefcbe07a48dc64aac3e309931de486ccbde395f06ade939461b56d8fbff08d46a785b502bf466300698d819dc268b56ea058eebc2052a4a2bf60f57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4388.exe

Filesize
468KB

MD5
18a460863f46aa476fce20afa431bc72

SHA1
56f259faf3db016330c5ec4bea00f02754c41005

SHA256
7c766f06c2c41af632867561701e141d7e1ceedb2df63b51a2a18ceb99cb3452

SHA512
cfab5657de3f805b03e18e2dc3c6fda19a6fbfbb327badb2fe68c2b76a241bce784fdbfd6b274f8f6df1f95667cdd2bfb2650f6f401b9b75d6aa5b5f19077045

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe

Filesize
468KB

MD5
766907845c119aec8354b6f5f5a94f00

SHA1
61cfa2fe5172abca38df008ea1c547ae48837e4d

SHA256
885de82be4eef83728d5917bbeb0045ee4f4061a9b3a677c1d4dd9690c2383bc

SHA512
252481e69fa5aacec96b8cb7416a145002d444fff1e2337affeb158d26a5416f49ee4744e66d9e97e1a0bab73e23c060819d7541f8de0edc9bb9d044508a484e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe

Filesize
468KB

MD5
26192a3b7c29b1a213fd61a7a6d1853b

SHA1
5cba4e4d96e4721da7552fd2df73f7f2315f6b64

SHA256
03ac3411613e434ba401f819eb2aa140c95ad4215c38b8aeb24976afb9f9291e

SHA512
3d0151e12ef0a9c9be9a3005d0f12d1a5b0108f8aac5a92bad7dd9e0f0af9847f5ac216ac222f1ec49867ded052b503e1884e2056df95f00ca45bec3cf283143

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54905.exe

Filesize
468KB

MD5
d3fb37c650e08bf84d80964353c463e2

SHA1
9276732ad3872fde92f6404460af98507f1fcd62

SHA256
b46e35f2bf58dd14bcbf9c53971a9a4fb354b2dcfbf89d251643059857aea578

SHA512
b3b69b6a5396ae1a8728542b7a8c4f83a22d9787692a8e51f9ac957c06ceadfc813dd38584cb33d4bcdc76d0e484569e6ae21d8b3272a8e36a9720446237e584

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe

Filesize
468KB

MD5
df40839227ab641ecc5f15745aec32f8

SHA1
73ae7254862172d3e4b43508441f37bc3e5d48c5

SHA256
2764a8f934dcfc1c50b78faef05ca174ddedfb34e4bc3be2effbc7d730e87305

SHA512
0d2ab8d16151594743a5c434c58dc5e5ad02f13bc4856901dc5676a60a583a2e269e2fee60b6e7338cb84d51f9b7af3f1adea5d319e044a851f3881a4317cdde

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe

Filesize
468KB

MD5
39a7be6e1089719ba7fa9694e1725fbe

SHA1
ca1cc06ba204a40a693ea1b1f93c6bde02ec631f

SHA256
6bc8b262a538a5737e462f27e3e5d022bc088b90c886ff3b093b448ad65b477d

SHA512
dde34d51871b192614a3060888ccf454debe2ada3e3966d5e9756988322d02c8d0174b173db9aa3d38b97aac843db08b24d0f3eee132ffe1d9dddebd7c77a206

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe

Filesize
468KB

MD5
0ef5420126487e327a47a76cf7f70f90

SHA1
2519e65d8309e55a7788fd4a1deafcdcbf80cfbf

SHA256
f6c8042de0d5a1d182e7a087b92d9b6d7d9117688fde8c6048b2222f13605ed2

SHA512
93572519b089253b643e699626a319698874b3bfc66899b529edd269ec2e1ebd8ad19fe384da4626125478b501ea954cd9ecf1250162bbf6686799f452cb993d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe

Filesize
468KB

MD5
28d8b8ed6319943d7214556e0467ddd4

SHA1
291fa1a311c33ed5ee073e75a6bb4b1793a795f9

SHA256
aaae05fb53fef4cbd23e8458ff18907c3d2aca667ece1bd4667b3680cd0a3e2d

SHA512
4545c8c58b269a1a5fe1fdd575fb313b4ebbea056b8d580d969dcea85d26454bbd12241081966e8bfcfb06145c1d3e8b37b76f374be34a2578ee513f813dddc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61196.exe

Filesize
468KB

MD5
3df0137277f91d14df3e89906eeaece2

SHA1
4e3901ae92e6f1a29a0f1099adc6d70fa25cf15e

SHA256
70fe242556818d3c27750bd2e1993a870d7c2511a4a05103395606255a8ed463

SHA512
f180da1309324da2dfd1b72c2dad245cda8e6ce34a593cea28ade8d0990be27e18f3ab0ec6b655cacecf38dafa6f362e36192c2e91fb4464016fa50f8e64ef60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe

Filesize
468KB

MD5
dc658ada264654bd85d298734e64134c

SHA1
6da27fa436cff77707d6f5b3381f899ae9bbca44

SHA256
1f832b795fb9e674e5d872ab9a2565c88e62273db10b7a990733ab769a4a791c

SHA512
f7792b2d9e2ca35661e7fbb064bd1c91fe8f13ee44645284f650839999a0da87067f84060cc7ee54e6856ef8b1491cd3712188ad3bbdd9d97c2be5b53c344db8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63795.exe

Filesize
468KB

MD5
edeb590b07838f83689d27f1582a7a3d

SHA1
e084a2676978f8d564b204f62da7dfa06e24e389

SHA256
5faebaa2d51e89b89bd200ae9cb09659bc61b025d24eb9523c183f2abf38ef52

SHA512
1765ad792fd4230aff5c11a6ef617d5290ece46ffdd9229917277d02a4617ea98116b2bbc5fdadae2f1275f82317ae0fd8ed11d07c5e9755a0f8c27f8c403bb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe

Filesize
468KB

MD5
8f7ecd1f0d4309487e98c6e88c1ddd78

SHA1
c3a94d44c41eac896140f701e16db5ab1a00190c

SHA256
48f06ecf11aa399a57e90b40e2470fbba6ae6c598bc1f7cb2c273d7d6f8caa30

SHA512
5f122d310320005e7a85eb4e5b739d3f8080f98bfcc1c8e4d35d5dc42dbb046733a57fd6dfe2fd17488368fee8feda033b4d43d066ca1a33ea96975199555aed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe

Filesize
468KB

MD5
5511a308c78850132fdb5baca17462e0

SHA1
a498eb60c4f7b367cddd4923c107481607e9b4aa

SHA256
9e2d4230ad762695078b9bcc2688e0ec92da2982be2863431812075e17ec0419

SHA512
47a3fcb075416652ed0d9ab298893970e3962909d21b30f669179a42535a5a7ddc8d05e4f40e5ff8b511cb6edfadb3f338d57633ec3f3532303027a66f51c35f

Download Submit
memory/17928-2742-0x00000000770C0000-0x00000000770E4000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads