eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139e

Analysis

max time kernel
117s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe
Size

468KB
MD5

5c3b76c1a5d88d293c94db0765715350
SHA1

5f80e5466ac68f892ace9d7386016b890d7432fd
SHA256

eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139e
SHA512

68cdc1aca64264921bd0a531d20943c88603971b6f0203a36e04b5559034e5767f53cb5fdf4ebfe6269b99a097f407aa54693020337289194f36149ab42dc76d
SSDEEP

3072:MEANoS7VId5UtbYxPztjpf8/SChbPgpwV0HeevsU4K08LVyCQZlo:MEqo9bUtSPJjpf4cyG4KdRyCQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4952	Unicorn-12656.exe
4024	Unicorn-39621.exe
3712	Unicorn-11587.exe
1044	Unicorn-13144.exe
3128	Unicorn-13144.exe
3092	Unicorn-55884.exe
2544	Unicorn-4082.exe
2688	Unicorn-61297.exe
4608	Unicorn-33263.exe
3588	Unicorn-57213.exe
704	Unicorn-44961.exe
4580	Unicorn-30662.exe
452	Unicorn-16927.exe
3024	Unicorn-36528.exe
472	Unicorn-39651.exe
3440	Unicorn-52309.exe
3108	Unicorn-16107.exe
1184	Unicorn-2916.exe
1652	Unicorn-30934.exe
2248	Unicorn-39865.exe
1424	Unicorn-43949.exe
4740	Unicorn-35781.exe
2332	Unicorn-27613.exe
2592	Unicorn-61032.exe
1108	Unicorn-52864.exe
2376	Unicorn-1062.exe
2480	Unicorn-5146.exe
3776	Unicorn-59828.exe
644	Unicorn-20981.exe
4324	Unicorn-2598.exe
2356	Unicorn-13126.exe
1784	Unicorn-8103.exe
3004	Unicorn-13723.exe
2672	Unicorn-59395.exe
2548	Unicorn-9255.exe
4720	Unicorn-46204.exe
3508	Unicorn-7401.exe
3968	Unicorn-45050.exe
1480	Unicorn-50651.exe
1444	Unicorn-10215.exe
4656	Unicorn-2047.exe
4924	Unicorn-2047.exe
4932	Unicorn-47164.exe
3860	Unicorn-43080.exe
3480	Unicorn-22395.exe
2460	Unicorn-2794.exe
2296	Unicorn-22660.exe
2312	Unicorn-5939.exe
2692	Unicorn-57178.exe
1516	Unicorn-43442.exe
5072	Unicorn-58462.exe
4136	Unicorn-46707.exe
4036	Unicorn-40842.exe
392	Unicorn-46972.exe
2512	Unicorn-31190.exe
2196	Unicorn-6899.exe
4744	Unicorn-56100.exe
4916	Unicorn-36234.exe
2956	Unicorn-47667.exe
4620	Unicorn-51440.exe
1560	Unicorn-16721.exe
1356	Unicorn-26936.exe
3504	Unicorn-64439.exe
1876	Unicorn-19728.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
17300	14996	WerFault.exe	747
16724	15484	WerFault.exe	766

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6987.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15726.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4556	dwm.exe
Token: SeChangeNotifyPrivilege	4556	dwm.exe
Token: 33	4556	dwm.exe
Token: SeIncBasePriorityPrivilege	4556	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe
4952	Unicorn-12656.exe
4024	Unicorn-39621.exe
3712	Unicorn-11587.exe
1044	Unicorn-13144.exe
3128	Unicorn-13144.exe
3092	Unicorn-55884.exe
2544	Unicorn-4082.exe
2688	Unicorn-61297.exe
3588	Unicorn-57213.exe
3024	Unicorn-36528.exe
4608	Unicorn-33263.exe
704	Unicorn-44961.exe
452	Unicorn-16927.exe
4580	Unicorn-30662.exe
472	Unicorn-39651.exe
3440	Unicorn-52309.exe
3108	Unicorn-16107.exe
1652	Unicorn-30934.exe
4740	Unicorn-35781.exe
2248	Unicorn-39865.exe
1424	Unicorn-43949.exe
1184	Unicorn-2916.exe
2480	Unicorn-5146.exe
2332	Unicorn-27613.exe
2376	Unicorn-1062.exe
3776	Unicorn-59828.exe
1108	Unicorn-52864.exe
2592	Unicorn-61032.exe
644	Unicorn-20981.exe
4324	Unicorn-2598.exe
2356	Unicorn-13126.exe
1784	Unicorn-8103.exe
3004	Unicorn-13723.exe
2672	Unicorn-59395.exe
2548	Unicorn-9255.exe
4720	Unicorn-46204.exe
3968	Unicorn-45050.exe
3508	Unicorn-7401.exe
1480	Unicorn-50651.exe
4656	Unicorn-2047.exe
4924	Unicorn-2047.exe
1444	Unicorn-10215.exe
3860	Unicorn-43080.exe
4932	Unicorn-47164.exe
2296	Unicorn-22660.exe
3480	Unicorn-22395.exe
2460	Unicorn-2794.exe
2312	Unicorn-5939.exe
5072	Unicorn-58462.exe
4036	Unicorn-40842.exe
1516	Unicorn-43442.exe
2512	Unicorn-31190.exe
392	Unicorn-46972.exe
4136	Unicorn-46707.exe
2692	Unicorn-57178.exe
2196	Unicorn-6899.exe
4744	Unicorn-56100.exe
2956	Unicorn-47667.exe
4916	Unicorn-36234.exe
4620	Unicorn-51440.exe
1560	Unicorn-16721.exe
3504	Unicorn-64439.exe
1356	Unicorn-26936.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 4952	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	86
PID 3320 wrote to memory of 4952	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	86
PID 3320 wrote to memory of 4952	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	86
PID 4952 wrote to memory of 4024	4952	Unicorn-12656.exe	87
PID 4952 wrote to memory of 4024	4952	Unicorn-12656.exe	87
PID 4952 wrote to memory of 4024	4952	Unicorn-12656.exe	87
PID 3320 wrote to memory of 3712	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	88
PID 3320 wrote to memory of 3712	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	88
PID 3320 wrote to memory of 3712	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	88
PID 3712 wrote to memory of 1044	3712	Unicorn-11587.exe	89
PID 3712 wrote to memory of 1044	3712	Unicorn-11587.exe	89
PID 3712 wrote to memory of 1044	3712	Unicorn-11587.exe	89
PID 4024 wrote to memory of 3128	4024	Unicorn-39621.exe	90
PID 4024 wrote to memory of 3128	4024	Unicorn-39621.exe	90
PID 4024 wrote to memory of 3128	4024	Unicorn-39621.exe	90
PID 4952 wrote to memory of 3092	4952	Unicorn-12656.exe	91
PID 4952 wrote to memory of 3092	4952	Unicorn-12656.exe	91
PID 4952 wrote to memory of 3092	4952	Unicorn-12656.exe	91
PID 3320 wrote to memory of 2544	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	92
PID 3320 wrote to memory of 2544	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	92
PID 3320 wrote to memory of 2544	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	92
PID 1044 wrote to memory of 2688	1044	Unicorn-13144.exe	93
PID 1044 wrote to memory of 2688	1044	Unicorn-13144.exe	93
PID 1044 wrote to memory of 2688	1044	Unicorn-13144.exe	93
PID 3712 wrote to memory of 4608	3712	Unicorn-11587.exe	94
PID 3712 wrote to memory of 4608	3712	Unicorn-11587.exe	94
PID 3712 wrote to memory of 4608	3712	Unicorn-11587.exe	94
PID 3128 wrote to memory of 3588	3128	Unicorn-13144.exe	95
PID 3128 wrote to memory of 3588	3128	Unicorn-13144.exe	95
PID 3128 wrote to memory of 3588	3128	Unicorn-13144.exe	95
PID 3092 wrote to memory of 704	3092	Unicorn-55884.exe	96
PID 3092 wrote to memory of 704	3092	Unicorn-55884.exe	96
PID 3092 wrote to memory of 704	3092	Unicorn-55884.exe	96
PID 4952 wrote to memory of 4580	4952	Unicorn-12656.exe	97
PID 4952 wrote to memory of 4580	4952	Unicorn-12656.exe	97
PID 4952 wrote to memory of 4580	4952	Unicorn-12656.exe	97
PID 4024 wrote to memory of 452	4024	Unicorn-39621.exe	98
PID 4024 wrote to memory of 452	4024	Unicorn-39621.exe	98
PID 4024 wrote to memory of 452	4024	Unicorn-39621.exe	98
PID 3320 wrote to memory of 3024	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	99
PID 3320 wrote to memory of 3024	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	99
PID 3320 wrote to memory of 3024	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	99
PID 2544 wrote to memory of 472	2544	Unicorn-4082.exe	100
PID 2544 wrote to memory of 472	2544	Unicorn-4082.exe	100
PID 2544 wrote to memory of 472	2544	Unicorn-4082.exe	100
PID 2688 wrote to memory of 3440	2688	Unicorn-61297.exe	101
PID 2688 wrote to memory of 3440	2688	Unicorn-61297.exe	101
PID 2688 wrote to memory of 3440	2688	Unicorn-61297.exe	101
PID 1044 wrote to memory of 3108	1044	Unicorn-13144.exe	102
PID 1044 wrote to memory of 3108	1044	Unicorn-13144.exe	102
PID 1044 wrote to memory of 3108	1044	Unicorn-13144.exe	102
PID 3024 wrote to memory of 1184	3024	Unicorn-36528.exe	103
PID 3024 wrote to memory of 1184	3024	Unicorn-36528.exe	103
PID 3024 wrote to memory of 1184	3024	Unicorn-36528.exe	103
PID 3320 wrote to memory of 1652	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	104
PID 3320 wrote to memory of 1652	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	104
PID 3320 wrote to memory of 1652	3320	eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe	104
PID 4608 wrote to memory of 2248	4608	Unicorn-33263.exe	105
PID 4608 wrote to memory of 2248	4608	Unicorn-33263.exe	105
PID 4608 wrote to memory of 2248	4608	Unicorn-33263.exe	105
PID 704 wrote to memory of 1424	704	Unicorn-44961.exe	106
PID 704 wrote to memory of 1424	704	Unicorn-44961.exe	106
PID 704 wrote to memory of 1424	704	Unicorn-44961.exe	106
PID 3588 wrote to memory of 4740	3588	Unicorn-57213.exe	107

C:\Users\Admin\AppData\Local\Temp\eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe
"C:\Users\Admin\AppData\Local\Temp\eeb3978b9bc2986353a5f7abe1af16280045810589f75c4a6cd2dd8ba0bd139eN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39621.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57213.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35781.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47164.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4927.exe
        8⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30880.exe
        9⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        10⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34590.exe
        10⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        10⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47351.exe
        9⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        9⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        9⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe
        9⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
        8⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
        9⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
        9⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        8⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48012.exe
        8⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13650.exe
        7⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        8⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        9⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16282.exe
        9⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39300.exe
        9⤵
        
        PID:17432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18570.exe
        8⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        9⤵
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        9⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38710.exe
        8⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39270.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4715.exe
        8⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        8⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36318.exe
        8⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        7⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23667.exe
        7⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        8⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        9⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22270.exe
        8⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50962.exe
        8⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        8⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        8⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17942.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25180.exe
        8⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        7⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30332.exe
        7⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15709.exe
        6⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11035.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        8⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16282.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        8⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30543.exe
        7⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        6⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        7⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29738.exe
        7⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
        7⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12882.exe
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        6⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        6⤵
        
        PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22660.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12711.exe
        7⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31072.exe
        8⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        8⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
        8⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
        8⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29618.exe
        7⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25276.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        8⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21013.exe
        7⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        7⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        7⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        7⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63094.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52556.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        8⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        8⤵
        
        PID:16308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43754.exe
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43474.exe
        7⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57609.exe
        7⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
        6⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3901.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60651.exe
        6⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9779.exe
        6⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39796.exe
        8⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38990.exe
        7⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38710.exe
        7⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26248.exe
        7⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1030.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4781.exe
        7⤵
        
        PID:18016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27305.exe
        6⤵
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        6⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46723.exe
        6⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        6⤵
        
        PID:10652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23761.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28877.exe
        5⤵
        
        PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22866.exe
        5⤵
        
        PID:8248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55272.exe
        5⤵
        
        PID:14164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16927.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13126.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58596.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        8⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        9⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
        10⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        10⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
        9⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42950.exe
        9⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
        9⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        8⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        8⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        8⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24055.exe
        8⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        7⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        8⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8010.exe
        8⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        7⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exe
        7⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27594.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        7⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
        7⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        7⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52238.exe
        6⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        6⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        6⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16721.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        6⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28628.exe
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
        7⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        7⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        7⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49603.exe
        6⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        7⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        7⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6987.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50496.exe
        6⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61731.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20609.exe
        6⤵
        
        PID:15832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
        5⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57924.exe
        5⤵
        
        PID:14632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3439.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41876.exe
        6⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
        8⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21465.exe
        8⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
        8⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13037.exe
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62639.exe
        7⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23621.exe
        7⤵
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe
        7⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9390.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11347.exe
        7⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
        7⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        6⤵
        
        PID:13424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11369.exe
        6⤵
        
        PID:16488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59343.exe
        5⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43038.exe
        7⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        7⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60961.exe
        7⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10018.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50962.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        6⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11257.exe
        5⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        6⤵
        
        PID:12812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11726.exe
        6⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        6⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29417.exe
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        5⤵
        
        PID:14720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
        5⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22358.exe
        6⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45342.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30211.exe
        6⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52814.exe
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61189.exe
        5⤵
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26469.exe
      4⤵
      PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40180.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10418.exe
        6⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10210.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        5⤵
        
        PID:12984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59339.exe
        5⤵
        
        PID:16500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4174.exe
      4⤵
      PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14279.exe
        5⤵
        
        PID:12880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
        5⤵
        
        PID:16092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
      4⤵
      PID:10676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62963.exe
      4⤵
      PID:14684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
      4⤵
      PID:6704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55884.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43949.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        7⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        8⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
        9⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22848.exe
        10⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29264.exe
        10⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        9⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
        9⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
        8⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3615.exe
        9⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43630.exe
        9⤵
        
        PID:16696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18687.exe
        9⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36442.exe
        8⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
        8⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
        8⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        8⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
        8⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        8⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26301.exe
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27279.exe
        7⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33413.exe
        7⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        7⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
        6⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        8⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        7⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4362.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
        6⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        7⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
        7⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42950.exe
        7⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39965.exe
        7⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15830.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18613.exe
        6⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        6⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50651.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
        6⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3111.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        8⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe
        8⤵
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        8⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63967.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38120.exe
        8⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13504.exe
        8⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        7⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        7⤵
        
        PID:14732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        7⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
        7⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
        7⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
        6⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
        6⤵
        
        PID:15712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        5⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27040.exe
        6⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
        8⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        8⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        8⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        7⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
        7⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
        7⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
        6⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        6⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36499.exe
        6⤵
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        5⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44964.exe
        6⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        6⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
        6⤵
        
        PID:460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
        5⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48171.exe
        5⤵
        
        PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61032.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5098.exe
        5⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        6⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43304.exe
        7⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        7⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29247.exe
        7⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22742.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        6⤵
        
        PID:15724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        6⤵
        
        PID:12004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
        6⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        6⤵
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26931.exe
        5⤵
        
        PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8945.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
        5⤵
        
        PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5763.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61731.exe
        6⤵
        
        PID:12976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53474.exe
        6⤵
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40541.exe
        6⤵
        
        PID:220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
        5⤵
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11789.exe
        5⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        5⤵
        
        PID:16964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4357.exe
        5⤵
        
        PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
      4⤵
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33356.exe
        6⤵
        
        PID:12404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        6⤵
        
        PID:16808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52587.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56774.exe
        5⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        5⤵
        
        PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57082.exe
      4⤵
      PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe
      4⤵
      PID:9700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54504.exe
      4⤵
      PID:12948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46920.exe
      4⤵
      PID:6780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30662.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27613.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46972.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12711.exe
        6⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exe
        8⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        8⤵
        
        PID:15484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15484 -s 448
        9⤵
        Program crash
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        8⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
        7⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38710.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26859.exe
        7⤵
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45658.exe
        6⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        5⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
        7⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
        7⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59411.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        6⤵
        
        PID:12952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        6⤵
        
        PID:16456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        6⤵
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11257.exe
        5⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19272.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25462.exe
        6⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
        6⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        5⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        5⤵
        
        PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13443.exe
        6⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35778.exe
        6⤵
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39774.exe
        6⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        6⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
        5⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60990.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
        5⤵
        
        PID:17196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe
        5⤵
        
        PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
      4⤵
      PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
        5⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
        5⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        5⤵
        
        PID:14592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
      4⤵
      PID:8556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61764.exe
      4⤵
      PID:16224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
      4⤵
      PID:1520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
        5⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54616.exe
        6⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        7⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27279.exe
        7⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33413.exe
        7⤵
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2489.exe
        7⤵
        
        PID:17884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47350.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14886.exe
        6⤵
        
        PID:14692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28694.exe
        5⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30939.exe
        6⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        5⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        5⤵
        
        PID:13560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        5⤵
        
        PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51367.exe
      4⤵
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        6⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43755.exe
        5⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33517.exe
        5⤵
        
        PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
      4⤵
      PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        5⤵
        
        PID:12280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        5⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
      4⤵
      PID:11272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10835.exe
      4⤵
      PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58462.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17372.exe
      4⤵
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24036.exe
        6⤵
        
        PID:13088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
        6⤵
        
        PID:16892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25845.exe
        6⤵
        
        PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
        5⤵
        
        PID:12236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
        5⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        5⤵
        
        PID:8628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29618.exe
      4⤵
      PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4155.exe
        5⤵
        
        PID:17272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        5⤵
        
        PID:16952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
      4⤵
      PID:10128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
      4⤵
      PID:13952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9733.exe
      4⤵
      PID:7488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29430.exe
    3⤵
    PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45592.exe
      4⤵
      PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39950.exe
      4⤵
      PID:9692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exe
      4⤵
      PID:13384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20034.exe
      4⤵
      PID:16780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60464.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
    3⤵
    PID:8000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20285.exe
    3⤵
    PID:9052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe
    3⤵
    PID:13400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30160.exe
    3⤵
    PID:3080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26936.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13479.exe
        8⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        9⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
        10⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        10⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        9⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        9⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        9⤵
        
        PID:16448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41870.exe
        8⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2639.exe
        9⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34486.exe
        9⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1533.exe
        9⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
        9⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        8⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        8⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14764.exe
        8⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43634.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12826.exe
        8⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47543.exe
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5401.exe
        7⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44698.exe
        7⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64439.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58596.exe
        7⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
        8⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        8⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe
        7⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
        7⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        7⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40584.exe
        7⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        6⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46723.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exe
        8⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        8⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        7⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23761.exe
        7⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24048.exe
        7⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45135.exe
        6⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37824.exe
        7⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12826.exe
        7⤵
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50886.exe
        6⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12550.exe
        6⤵
        
        PID:13412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        6⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3055.exe
        6⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59395.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
        6⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
        8⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56059.exe
        8⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        8⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
        7⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        7⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        7⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55804.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44315.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16568.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
        7⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        7⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11589.exe
        6⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
        6⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14173.exe
        5⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16900.exe
        6⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2831.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18150.exe
        7⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26421.exe
        7⤵
        
        PID:16400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        7⤵
        
        PID:17824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37070.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30019.exe
        6⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe
        5⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16282.exe
        6⤵
        
        PID:14996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14996 -s 436
        7⤵
        Program crash
        
        PID:17300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        6⤵
        
        PID:15348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
        5⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31626.exe
        5⤵
        
        PID:12868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18339.exe
        5⤵
        
        PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        6⤵
        Executes dropped EXE
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51736.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
        9⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30017.exe
        9⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17179.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        8⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        8⤵
        
        PID:16420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        8⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11918.exe
        8⤵
        
        PID:16828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        8⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        7⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        7⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20156.exe
        7⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39846.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19012.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4855.exe
        8⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        8⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
        8⤵
        
        PID:17584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        7⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58938.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        7⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        7⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19425.exe
        6⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        7⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21465.exe
        7⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53333.exe
        7⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48067.exe
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        6⤵
        
        PID:14192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        6⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20090.exe
        5⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23148.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45992.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49443.exe
        8⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50436.exe
        8⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        7⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        7⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        7⤵
        
        PID:17440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
        6⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        7⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        7⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
        7⤵
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36397.exe
        6⤵
        
        PID:14564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        6⤵
        
        PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exe
        6⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51450.exe
        6⤵
        
        PID:14544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        5⤵
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        5⤵
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12333.exe
        5⤵
        
        PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
        5⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29152.exe
        6⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
        7⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34921.exe
        7⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        7⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30019.exe
        6⤵
        
        PID:15384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11803.exe
        6⤵
        
        PID:520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        5⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        6⤵
        
        PID:15836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
        5⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28066.exe
        6⤵
        
        PID:16680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        6⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37829.exe
        5⤵
        
        PID:13352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16982.exe
        5⤵
        
        PID:16516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4155.exe
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32291.exe
      4⤵
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16900.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        6⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32986.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30019.exe
        5⤵
        
        PID:15048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
      4⤵
      PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exe
        5⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24938.exe
        5⤵
        
        PID:17008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59180.exe
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48692.exe
      4⤵
      PID:12824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
      4⤵
      PID:16112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33263.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12135.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        7⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25696.exe
        8⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35778.exe
        8⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        8⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56380.exe
        8⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40578.exe
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        7⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47436.exe
        7⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64875.exe
        6⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17108.exe
        7⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        7⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
        7⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56827.exe
        6⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
        6⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58959.exe
        5⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17284.exe
        6⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
        7⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31327.exe
        7⤵
        
        PID:17072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31729.exe
        6⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64803.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50482.exe
        6⤵
        
        PID:16672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        6⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        6⤵
        
        PID:16888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46928.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        5⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe
        5⤵
        
        PID:16080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        5⤵
        
        PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18833.exe
      4⤵
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57932.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        6⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
        6⤵
        
        PID:14580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8201.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4362.exe
        5⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56380.exe
        5⤵
        
        PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6686.exe
      4⤵
      PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
        5⤵
        
        PID:12756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        5⤵
        
        PID:16736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10711.exe
        5⤵
        
        PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
      4⤵
      PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6215.exe
        5⤵
        
        PID:15040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25564.exe
        5⤵
        
        PID:17420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19374.exe
      4⤵
      PID:12560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56531.exe
      4⤵
      PID:7964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1062.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49084.exe
        5⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13199.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4715.exe
        7⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34921.exe
        7⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        7⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        6⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        6⤵
        
        PID:17224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        6⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61175.exe
        5⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18120.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25462.exe
        6⤵
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11693.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11710.exe
        5⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
        5⤵
        
        PID:16164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
      4⤵
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        5⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51524.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        6⤵
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        5⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        5⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
      4⤵
      PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20734.exe
        5⤵
        
        PID:632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
      4⤵
      PID:9780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8665.exe
      4⤵
      PID:13476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
      4⤵
      PID:16528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
      4⤵
      PID:14384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22395.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
      4⤵
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        6⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
        6⤵
        
        PID:13440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        6⤵
        
        PID:17300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37070.exe
        5⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
        6⤵
        
        PID:13564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58604.exe
        6⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
        5⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
        5⤵
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15887.exe
        5⤵
        
        PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
      4⤵
      PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12826.exe
        5⤵
        
        PID:14648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29199.exe
      4⤵
      PID:13216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42314.exe
      4⤵
      PID:16708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
    3⤵
    PID:224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
      4⤵
      PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        5⤵
        
        PID:9876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        5⤵
        
        PID:17368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
      4⤵
      PID:8244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
      4⤵
      PID:12968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe
      4⤵
      PID:7256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28102.exe
    3⤵
    PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
      4⤵
      PID:13604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
      4⤵
      PID:7768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51416.exe
    3⤵
    PID:9672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32973.exe
    3⤵
    PID:12380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62823.exe
    3⤵
    PID:17388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
    3⤵
    PID:568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4082.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4082.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39651.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6899.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18120.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25462.exe
        7⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        6⤵
        
        PID:16244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3820.exe
        6⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38730.exe
        5⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25520.exe
        7⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
        7⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34099.exe
        7⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
        6⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7839.exe
        7⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
        7⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        6⤵
        
        PID:12960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        6⤵
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        5⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26916.exe
        6⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        6⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        5⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        5⤵
        
        PID:13680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24585.exe
        5⤵
        
        PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36234.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30584.exe
        5⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
        6⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47351.exe
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52978.exe
        6⤵
        
        PID:16932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63197.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33702.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11428.exe
        6⤵
        
        PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
        5⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59012.exe
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
        6⤵
        
        PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23221.exe
        5⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        5⤵
        
        PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
        5⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        6⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14869.exe
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        5⤵
        
        PID:15624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
      4⤵
      PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
      4⤵
      PID:10908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
      4⤵
      PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49282.exe
      4⤵
      PID:17800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56100.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exe
        5⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24352.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        6⤵
        
        PID:15736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16789.exe
        5⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
        5⤵
        
        PID:16888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19618.exe
      4⤵
      PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40880.exe
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9235.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        6⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        5⤵
        
        PID:15284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27791.exe
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52238.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
      4⤵
      PID:10920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
      4⤵
      PID:14804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exe
      4⤵
      PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        5⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        6⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        6⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
        5⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36805.exe
        5⤵
        
        PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53354.exe
      4⤵
      PID:8588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3621.exe
      4⤵
      PID:13084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
      4⤵
      PID:17188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39230.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exe
    3⤵
    PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
      4⤵
      PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-418.exe
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        5⤵
        
        PID:15352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60755.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56774.exe
      4⤵
      PID:13320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32287.exe
      4⤵
      PID:16692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43552.exe
      4⤵
      PID:7672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12342.exe
    3⤵
    PID:7528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
    3⤵
    PID:9060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33741.exe
    3⤵
    PID:14172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16564.exe
    3⤵
    PID:1148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36528.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36528.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10215.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        5⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62446.exe
        6⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
        5⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exe
        6⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        5⤵
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        5⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47436.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62851.exe
      4⤵
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62291.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        6⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        5⤵
        
        PID:17264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
      4⤵
      PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39588.exe
        5⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        5⤵
        
        PID:17376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        5⤵
        
        PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47299.exe
      4⤵
      PID:9764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
      4⤵
      PID:13116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
      4⤵
      PID:17308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
      4⤵
      PID:6416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
      4⤵
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44964.exe
        5⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
        6⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11726.exe
        6⤵
        
        PID:16944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        6⤵
        
        PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
        5⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11568.exe
        5⤵
        
        PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
      4⤵
      PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
      4⤵
      PID:11068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
      4⤵
      PID:16236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19580.exe
      4⤵
      PID:9928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33353.exe
    3⤵
    PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2867.exe
      4⤵
      PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        5⤵
        
        PID:13824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        5⤵
        
        PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38990.exe
      4⤵
      PID:8224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38710.exe
      4⤵
      PID:12664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43387.exe
      4⤵
      PID:16200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37543.exe
    3⤵
    PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-418.exe
      4⤵
      PID:13820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
      4⤵
      PID:4048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
    3⤵
    PID:10228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exe
    3⤵
    PID:14144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14383.exe
    3⤵
    PID:5784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30934.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30934.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
      4⤵
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
        5⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13651.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36022.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        6⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        5⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        5⤵
        
        PID:17164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        5⤵
        
        PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
      4⤵
      PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52726.exe
      4⤵
      PID:816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
      4⤵
      PID:12568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
      4⤵
      PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
      4⤵
      PID:7684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53531.exe
    3⤵
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41404.exe
      4⤵
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34921.exe
        5⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27713.exe
        5⤵
        
        PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49707.exe
      4⤵
      PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12285.exe
      4⤵
      PID:12248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4362.exe
      4⤵
      PID:16188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11263.exe
      4⤵
      PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
    3⤵
    PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53340.exe
      4⤵
      PID:9892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
      4⤵
      PID:13328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
      4⤵
      PID:16736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe
      4⤵
      PID:8160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50231.exe
    3⤵
    PID:8476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7129.exe
    3⤵
    PID:12908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1274.exe
    3⤵
    PID:16412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
    3⤵
    PID:6696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45050.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45050.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
    3⤵
    PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39920.exe
        5⤵
        
        PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        5⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        5⤵
        
        PID:15120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
      4⤵
      PID:7924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
      4⤵
      PID:12224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
      4⤵
      PID:14452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
    3⤵
    PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
      4⤵
      PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41206.exe
      4⤵
      PID:11128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41118.exe
      4⤵
      PID:15016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61501.exe
      4⤵
      PID:5756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32933.exe
    3⤵
    PID:8312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60990.exe
    3⤵
    PID:12300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
    3⤵
    PID:17172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3543.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3543.exe
  2⤵
  PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63744.exe
    3⤵
    PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
      4⤵
      PID:9976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
      4⤵
      PID:13492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42950.exe
      4⤵
      PID:16580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exe
      4⤵
      PID:1248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
    3⤵
    PID:9136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
    3⤵
    PID:11172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
    3⤵
    PID:15784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50952.exe
    3⤵
    PID:7824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe
  2⤵
  PID:6736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12743.exe
    3⤵
    PID:12744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11726.exe
    3⤵
    PID:16956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
    3⤵
    PID:5604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
  2⤵
  PID:9708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
  2⤵
  PID:13364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
  2⤵
  PID:16772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
  2⤵
  PID:8712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 14996 -ip 14996
1⤵
PID:17340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 16272 -ip 16272
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 15712 -ip 15712
1⤵
PID:17228

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1062.exe

Filesize
468KB

MD5
c30908302dda59d0e44bf08c036a8167

SHA1
86d1e30fecee89e996214c49bdb33ada0add858d

SHA256
b46876b6a48070338589b70b797bb8f545c0182e0e5bcc9622230365695bb3dd

SHA512
65fd4b586e65013f0d2f8b3331d9a2ffe67f7689c34ff99528de89cb0494bf26283adf8b45514dbfdb095901189e55e4b2279b99a5d96e33b3f192f9bb10e030

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe

Filesize
468KB

MD5
189a35317c7e13ab571a92c7f3303b0d

SHA1
000705e1d2d31ab96b4fcd244f6daba7a4c5c2c4

SHA256
69f3d307a0ffc2580013b569878d35deafbf1c0152872f921308362cfbffcbee

SHA512
d143dc74e3eafc7121d77c5b97c2eea222da680975d2160b50bbaf87bc7d1435c6eeafc73ac9c724f5e00b1907f617056e1b59d6aeda414946fcb5033a589013

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe

Filesize
468KB

MD5
56225bf402d7d03c030b67c83cef69d7

SHA1
04a1ebc81665b0c5e7a7f2b9fe58b71a27977c29

SHA256
b3e1a8972050ee070bf9995d8d3e048ed92da1d97134f8aee606723b27aad03d

SHA512
a4942847c3260f71e5d150abdbfdf2a483f1bece8c07db7e26edf706412cba6abb7d9592b1bdc92a275d4b0107f6635d2d5350076f9a31e883e4dd3a57149908

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13126.exe

Filesize
468KB

MD5
a162ecea2ec00c3ed07683175d49667c

SHA1
29b79c546c3cb6933f95717bbe9b629d48a44bd2

SHA256
923988081def655d7bad2da162335b6cb367d35a355d172e1b13a90bfc6cfc61

SHA512
e2a598b254e72d086b2ed9a62fef060e92f174cf84e05fa093fa11b88837bfaa6a23a878f96df991c93ec866e2bee76586fe5a32eacc0c69511365fdc5b348ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe

Filesize
468KB

MD5
53847297d68ac7fda93e4028528fdd22

SHA1
b318b4f306c4c6337e9da515f13e59fc15566652

SHA256
4e51a5702cbb0abe6b86aa54a2276e89cd6b089b240eadea162e2675dd0e0271

SHA512
80d9ee1917c5d6a26f63d7564597d584f68fe7dcfbcc1adae2e932d3c77a17c9e08befb44ba1e47bf5e8414b047305a7af74dbe58cc51e4742ee077244a3fbe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe

Filesize
468KB

MD5
63f15fb1caf7535feb07aed8c577cf2c

SHA1
ccdce0169cc7d8e4cecb53edc1234cb212098757

SHA256
3d772d4a5c8aba578ec2d0f11ec7d80921714a1b14ad12293e6ce915c0c4de97

SHA512
b0929a94287624afe1950a58651eb0a3efe528ed94ad70fa5a333ca5daa3bb9631f23d661b1d46284752b0bef14adbb303ca133d6aa05e08ec8d1938659205f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16927.exe

Filesize
468KB

MD5
04c85bb8c40e6d58c2ec0a1e66e268c8

SHA1
3695d336b1ba4675f631f2278978d9d9eb0b97f5

SHA256
61e292d11bd75b028b0e4af327b314c7ff5030ed796fcc6fab7e94abfc03ce92

SHA512
f8d128fe4cf4e954f8fa5d412c9a0bab5d5e0e3d6ae882b042dbdfcad32d71f52bd5ff1d4a684d581a69b95a5aecf6227eb475a5e5a4bde5e0257d8e0b7d1359

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe

Filesize
468KB

MD5
ec598debacc6218a9d59bf5ec5300b71

SHA1
ff26d95aa870e7110952cb92f2fa32b294322cee

SHA256
e9e03aa75d97b9a73c93125df0ba758a4e4b4bc310033c4096aa3a6a50edc4db

SHA512
8a7c7695cc611c636f53790085594a8fa7ef3d06f90c1438411f62c91868ea824044641181b55b89a887f88ddb7ee12e163bcfe9b6df371b1c63708eab4f9e71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe

Filesize
468KB

MD5
520184ea2b6ed69d4448384b2186a810

SHA1
db1ff9d96539e4854d6cb3195030e5e3d88b4b1d

SHA256
576d1584e382d0e447140722b4c970c6bc9505b9e47591d7f07a3f57ebe76d36

SHA512
6fa69b0d3883d177f9efe629b155182302781fbf6d0f043de63279e535423fd57f71cb4d14e0de0c1be8ed0d3087a7ab71a443cdcd19b3c8977e87ce3dce2a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27613.exe

Filesize
468KB

MD5
f9c3ac3373640a93542089b29db8f58e

SHA1
cce9d3456b0f1a132418d7201794e58bb8d3f9c1

SHA256
f2ec538f450430f332f0d8c690068f150c4514f19e2b43c967a43e02d3e074a6

SHA512
78f61b3b71ec52a9b59523bd19a84ad8992c9bcd3b8b4cb1f189a9b2fc867e38c7742f74361d4538130b24d1c6db2fe4b2051aba40db1c701f8ff4140e5c5c67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe

Filesize
468KB

MD5
1733d5a90a493cb25bad38092d9be059

SHA1
00b0624fc833324b5a29bbfbb24437fe3ef2352b

SHA256
bea709b9ed23df8b989dacadb5c2e5315f6f7eb80cef1a9652479a872fddd20d

SHA512
9de82a27920306c6afb303f124244a45a2c4e86637db060ab522fa527f1f15568075b4729336009a7d827a352762cb8a5fda9b1f2a2cfc93ec69469f23d2dc32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30662.exe

Filesize
468KB

MD5
9cc037f2195b36b80c86e6a4e3ff15e4

SHA1
4fc6a91c3b16a6beef69a2f5ed0858adec1913d3

SHA256
abf4d4422c1007094be0f2a24b8c5d7c421ac545989339040a23b91337457651

SHA512
a15eab8c0827a2a82d04a151306adba7d1b4b82fd5064943b8f8677192dd5e42ae6b622a6fb08ce5232fbcd1077793a811b6e8480d37b8d418a5b9f10a1e850e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30934.exe

Filesize
468KB

MD5
bd7ac3cb9baad2fb74531537121981b7

SHA1
c4d6ee59ae2dd5332aff21de4202a88dd0e0807d

SHA256
60d4bd685e4c2779a8b74d9ddc65e50bb53b221bd7b6c94f56ebaf97800706f3

SHA512
5bb36458835dcc4cabbe0e486fe299657d25535ecb9a30b4c7bc8b455072bc92fea231a3c4cd97a039f72ef3c2bf40aa23030c5aab1243d6f87b51002928d32d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33263.exe

Filesize
468KB

MD5
861016034244b7b01108ab8421b53d24

SHA1
240ee2dfb84d6299284e3f5bd406971477bd815c

SHA256
9ecf883f879d110838c0891fbef804922ddec13143f7b694596c8f64b5a8273e

SHA512
3634479f6fb4f73f163f5f36bd434e1ee99e9ae0b28e7573662c4adc0de5df7d665834709b967be6927555c226146133d3dc79af5f23c27d9fa9af085725be45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35781.exe

Filesize
468KB

MD5
1262e49a75369679dce42dc3dcd81a64

SHA1
272d761d3a8613a5da9353d627728d77012eb8a8

SHA256
d8831d1ac81e52c4a89f059c1c8a59895c7f5ff3f8fe9c98bb1889fdcc2861d8

SHA512
e642353775b7f25d17aecfa7477e16ad1a21d8aac673485cfbaab4537bc39bed3f97288790d033fe74f910d49f80132080ee413bb0b8314b49ecdbaa17de743d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36528.exe

Filesize
468KB

MD5
ceaa3810b32697c29a3993d7e0942019

SHA1
ff3e868d548e4eaaa96214a2cd650da24f02cb12

SHA256
1ee8863d0f1a3b986f5dd050452dfdc8fa9fbb4a0e78c589da59f8fc9db0b6ee

SHA512
981772996922c8f0c99498b07026eebd878756674613d17f7284819e41395b1ce55d2bed002360ba7356d726ab03df9cd46ce17c6d86c9ebf09279ee6f1fc071

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe

Filesize
468KB

MD5
4e6379053e36f1fce4963a8efadecc2d

SHA1
4a1253f45b21e4d10da79649b37d3722d36f9b2f

SHA256
7daeb15865ac5819056813e21ccb27ab5eb6aac415cc6048478564f9536f3748

SHA512
7876110660ea67074c14aa80a190c263186c9625eda3e1782c8c96a80b3d75c960e40cdddd48d1f45e4a23dae61baca590b7c9864a2bd2baf87b28b57fdd203e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39621.exe

Filesize
468KB

MD5
39578adf9f90a01df8a3c7a37cca51ed

SHA1
9e88af2f7a982866038e5d10fff2de9964c1b1dc

SHA256
39cc9db0c5a131dd8dd693cfe5c2018414dbc77456a15cdbe7c0f2afc23c1f2c

SHA512
8372f83b52ae8408c26b57e414edf8664b2ab35b0f9c1a9ffc19fb9595d4522d0e18fa80dcfff85d812f41efb7860c12f6ac7d2de87e2d0dec52a86713b5a3f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39651.exe

Filesize
468KB

MD5
74cea8261d1443023e7cce9976cc9369

SHA1
dfecd86becd4a193baefe86b4baeb0af85386c56

SHA256
a0d50b315d4505da3b2cfebf9ebeaff847a8dfa011869c5e62e1e23d9637b333

SHA512
e52690820c5d86622411930e86044925a2c18710b60ac4ac55bc38ee7d8615e227c8c187eaac979eb5f01c383ddee6ea17aaf396baa260698c72f9a92af719bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe

Filesize
468KB

MD5
b4aca831ae64c4b68019eae0eeef71c3

SHA1
1eb2ae95c57e97d284cdf8bfdb41bff625643276

SHA256
e6d190ef16c9fc671381cdf1c41ff5a5eceefa9b9750c34c944ec9fc2c5322f7

SHA512
b3f37b501ac7727952fa083c8f4e2ec5ad2c2345895a7b93f84697483cfeab61787983af7ff40bb0e956f830c7080c0317a2af128f7c47457fa39e6990493d2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4082.exe

Filesize
468KB

MD5
af011a82321101c33c007168c6536a33

SHA1
e039fba772967130eeca8108936bb022cf674013

SHA256
92b6a0146fa00a2547f02a5926b543d57b8f5b686427a8729a31e433e98696f2

SHA512
96e704c3a4c598960972ebb9a26a474f02031db7142f6e0603078b1e99c8d6afbfa79bbb9cffbce73b8330e36cc0aee1fbdae95ff3103dd5a2e070576745ee32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43949.exe

Filesize
468KB

MD5
13fe0e64e769988533f9f38fc40e5948

SHA1
7177511ec4b7f75dfb0f08ac76d28765435b438c

SHA256
abbb38f045267c4cf2e568efbdca81558a90708ed6d443729f4e44b51d210626

SHA512
6914f7df14efbb62fa9e8be42cf321e4b3e8d0c739269d951363d9ae26b035f855d633578de4c37d593affc526db8038dc20faf812655a27ca113234fe305fe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe

Filesize
468KB

MD5
8768ffda8cba0ba9eedef637ecceb820

SHA1
adb850a2e527f7c30bb44121a020add21cdb841a

SHA256
bc28840a31ba9cbc809bbefc35821e49ea95490d749ed14475fdcf4dacc17e47

SHA512
1adc70f91e6da36c7b8dd9882eccc3946b6d0c5f1dfe2c65a59f9393c480b7e98f7775a8adb0f095465c811f439499f510046446345d2951b4efe590cfabe214

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4855.exe

Filesize
468KB

MD5
f4eb0e33e068a2f7e9a1615d9e2d376a

SHA1
b33c86c3d4e336a8d55f33ebd898e7ea848ef705

SHA256
eac9c3b6b3b4339080fc8779e723c76275628b9d8a4e3ff85860975b39f85bea

SHA512
03cc93af5aacbe40026ff6d9de0354422d3ad1d34192c08e96bb4793e124f1faf117ed72572cb1320c089fb5a32328b11bfda03db8c3d34b6f8349d87359fd0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe

Filesize
468KB

MD5
d147bb11739f4fa1dfca623f3b687724

SHA1
8973e722981dc10d4a55eea42c86ae37458c2264

SHA256
bacf4b0363785eb80afceefd91882551c3373c835cf7677c7641cf1d23cdbb7e

SHA512
e56f32bf664866ef82b62d9d99e781a8591784f7036738dac45894baac6a8fdb888ce912966a23a588c7329d8dc82358aa9808e4e6db1902aae0b11a96191f4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe

Filesize
468KB

MD5
8aca7bc8a8d39123544444db4a3b76dc

SHA1
4c046cb6baf69d1fc3ffbfdd3c41feee3c0ae85b

SHA256
889871efa7e2e6b02413f0699267e4f05b22d80d432599f148672de79d8a2fd8

SHA512
a49a8061759157ba0135c983164d33268bd5a5433bc5dc3b7e526a36abe8be9923aafeb525252bffcc96ba83ed0f61db11cdd53acb3649538cfdb5954a6aa89a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe

Filesize
468KB

MD5
9d066e9c91c263baa4c22e0a906989b1

SHA1
8f4403bdcf817b1eba7bce3f7649b2d0b91919e0

SHA256
26f3c72499c1232c8c02e211c2d9f8571d9e860941f041ba768d80c8e22eb54a

SHA512
c0703d0f73fec398b2c25e572ab3f058196e342de2e828a214aa1d8cbd31c2204cdb66a32bb7abba4c9f52c69def9e075f811c6db26e9909296f8332952f89bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55884.exe

Filesize
468KB

MD5
b438accf352d1bad614969f5784fe8bf

SHA1
806a97c7ab047407497b6d00c22bb3e318573098

SHA256
fd074be0c5fdba7a9e9879c16cabce67a6ca8009d0f1e03127be7491d83ce3a9

SHA512
c802990d5892edc199394318aaa5a48bd5c9d100312ec7f3997e6e05ba260704a8cbe58add95a69cbbbc13aad2b983e3647d32b2bdbade8ca1a0964c49b286aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57213.exe

Filesize
468KB

MD5
b51cfd3dcb5f4c72593160b696462175

SHA1
6b6a7e32467720738abd8ada2a2e7da311d444a8

SHA256
8f7d1d41038cd3e27d778ea49e7acea133652c3e97a9e1b4d40ff5c07da2000a

SHA512
c188655bede05c63e77ff600b095f157242af18c01448abc6fee4874b9593dfc8a0e4c106babaf725bf469dff44acc0df5b4f12fbbbabf04c10029e1a2c80c4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe

Filesize
468KB

MD5
628ef9a638c5a5d49320b101cc4eee9e

SHA1
0734f93bd77ff504b4980009faa65a1a201817f3

SHA256
90cb5acc42dedb7e66bcd2d713e074df7feb1f00023fc765efb7b41feea27a9d

SHA512
244f12ed34842c5928471017492b71eb1f2f3296a448084423c4baf9b514651469a5b6e21d50f90f203d3944b305d794aa7ea5986ff278cbbab8cc090eb10a39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61032.exe

Filesize
468KB

MD5
0f4c7d04beebf0c6633bf2c96e8f572a

SHA1
7b1176ce19900ed5e761c5f5e0129c1bf58fd5d6

SHA256
56eea2c5d83a12645419f9116bc01ecdb15346454cf5924308214d0c3b282115

SHA512
0da5f0a3dbfa4a57fe88a6cb24e8c703847ebcc7629e4d08000aace0112c2f051d65e8f5cd4ea3a2d3cb43e4039f58269e6afdd8f0e588f4fa64dafe141e8d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe

Filesize
468KB

MD5
27863fbf76eefbc648ad0939610d00e3

SHA1
9467bb8d4e491d4b3dda2123f4baf3f494cbf8aa

SHA256
76e93e356396b146d220f734a3d47de7e3f4005bdeed86626fb0bd552b45971f

SHA512
801e6526d9e5766df5c21b224101c07900886ffb203c985dd1f336c6672d807760b9d66ccd557c34c0166a5bbb40bf0c8575afda54793ca78fee1bc7fd34344c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6899.exe

Filesize
468KB

MD5
8d6bbc9d24b4dc5a63bbc53828317c6e

SHA1
84b44dcd45474edab275fcc61f491df94c9652b2

SHA256
32da9ab62e521d63eb157740cd52b1fe83fdeca0fa0894b7d2e36a11aa15311d

SHA512
aafe57b92b02832b94b61b9e0de9a9711fe940c5a5fcbdce7374b158801f6497687991302bcc55d13e79ce4f592c1a2f12825fd1cba4b829c420c10e25d32bf8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads