b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe
Size

468KB
MD5

fa393007fab3ec47dd85dc095a89d96f
SHA1

bd59fe103d558a10a2185aae25911fe7e66cbfcd
SHA256

b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c
SHA512

2de06d3805f1724f684968308ab008da2bf03f8881e71c962f6a34c314787fb4148a4160938e83b35132d0ae2bc8521369062255a472580ac7b14989d95073ac
SSDEEP

3072:Za7UovIw735/tbYtPgV5Of8/E5Rd+IXPmmHhPS6LNGXw3BzuSfl6M:ZagovJ/tSPc5Ofs2bFNGAxzuSz

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2952	Unicorn-18618.exe
3348	Unicorn-17030.exe
4760	Unicorn-50449.exe
2164	Unicorn-49230.exe
3688	Unicorn-34931.exe
2188	Unicorn-20450.exe
1868	Unicorn-584.exe
1172	Unicorn-59318.exe
4852	Unicorn-32244.exe
2272	Unicorn-52110.exe
4940	Unicorn-24076.exe
1944	Unicorn-43942.exe
5116	Unicorn-33727.exe
4732	Unicorn-18596.exe
3416	Unicorn-41742.exe
3600	Unicorn-45504.exe
3644	Unicorn-21514.exe
4140	Unicorn-21514.exe
1668	Unicorn-42894.exe
2140	Unicorn-18124.exe
3976	Unicorn-22474.exe
2424	Unicorn-16343.exe
4876	Unicorn-2608.exe
2192	Unicorn-63314.exe
1792	Unicorn-15052.exe
1328	Unicorn-28787.exe
1440	Unicorn-25987.exe
2736	Unicorn-23818.exe
4260	Unicorn-7289.exe
4476	Unicorn-43152.exe
2096	Unicorn-4912.exe
2160	Unicorn-29608.exe
2840	Unicorn-41306.exe
3988	Unicorn-20864.exe
1976	Unicorn-61150.exe
4920	Unicorn-26292.exe
2776	Unicorn-37414.exe
4736	Unicorn-45582.exe
4504	Unicorn-21078.exe
1176	Unicorn-42052.exe
4468	Unicorn-42052.exe
3484	Unicorn-20308.exe
1372	Unicorn-657.exe
4604	Unicorn-38566.exe
1540	Unicorn-30398.exe
2308	Unicorn-17383.exe
448	Unicorn-26314.exe
4404	Unicorn-5701.exe
3676	Unicorn-55457.exe
5064	Unicorn-63070.exe
1800	Unicorn-48772.exe
848	Unicorn-38493.exe
1864	Unicorn-32627.exe
1252	Unicorn-30325.exe
5020	Unicorn-14601.exe
1700	Unicorn-35576.exe
1956	Unicorn-47274.exe
684	Unicorn-31898.exe
3940	Unicorn-64305.exe
2456	Unicorn-58440.exe
1708	Unicorn-56402.exe
4440	Unicorn-36536.exe
2752	Unicorn-44150.exe
4904	Unicorn-28006.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2592	3688	WerFault.exe	96
3404	5632	WerFault.exe	185
8332	6552	WerFault.exe	243

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45088.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	8056	dwm.exe
Token: SeChangeNotifyPrivilege	8056	dwm.exe
Token: 33	8056	dwm.exe
Token: SeIncBasePriorityPrivilege	8056	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3264	b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe
2952	Unicorn-18618.exe
4760	Unicorn-50449.exe
3348	Unicorn-17030.exe
2164	Unicorn-49230.exe
3688	Unicorn-34931.exe
2188	Unicorn-20450.exe
1868	Unicorn-584.exe
1172	Unicorn-59318.exe
2272	Unicorn-52110.exe
4852	Unicorn-32244.exe
4940	Unicorn-24076.exe
1944	Unicorn-43942.exe
5116	Unicorn-33727.exe
4732	Unicorn-18596.exe
3416	Unicorn-41742.exe
3600	Unicorn-45504.exe
4140	Unicorn-21514.exe
3644	Unicorn-21514.exe
1668	Unicorn-42894.exe
1440	Unicorn-25987.exe
2192	Unicorn-63314.exe
2140	Unicorn-18124.exe
3976	Unicorn-22474.exe
4876	Unicorn-2608.exe
1792	Unicorn-15052.exe
2424	Unicorn-16343.exe
1328	Unicorn-28787.exe
2736	Unicorn-23818.exe
4260	Unicorn-7289.exe
4476	Unicorn-43152.exe
2096	Unicorn-4912.exe
2160	Unicorn-29608.exe
2840	Unicorn-41306.exe
3988	Unicorn-20864.exe
1976	Unicorn-61150.exe
4920	Unicorn-26292.exe
2776	Unicorn-37414.exe
4736	Unicorn-45582.exe
4504	Unicorn-21078.exe
1176	Unicorn-42052.exe
4468	Unicorn-42052.exe
3484	Unicorn-20308.exe
1372	Unicorn-657.exe
4604	Unicorn-38566.exe
1540	Unicorn-30398.exe
448	Unicorn-26314.exe
848	Unicorn-38493.exe
5064	Unicorn-63070.exe
1800	Unicorn-48772.exe
2308	Unicorn-17383.exe
3676	Unicorn-55457.exe
1864	Unicorn-32627.exe
4404	Unicorn-5701.exe
1252	Unicorn-30325.exe
5020	Unicorn-14601.exe
1700	Unicorn-35576.exe
684	Unicorn-31898.exe
1956	Unicorn-47274.exe
3940	Unicorn-64305.exe
2456	Unicorn-58440.exe
1708	Unicorn-56402.exe
4440	Unicorn-36536.exe
2752	Unicorn-44150.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2952	3264	b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe	87
PID 3264 wrote to memory of 2952	3264	b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe	87
PID 3264 wrote to memory of 2952	3264	b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe	87
PID 2952 wrote to memory of 3348	2952	Unicorn-18618.exe	92
PID 2952 wrote to memory of 3348	2952	Unicorn-18618.exe	92
PID 2952 wrote to memory of 3348	2952	Unicorn-18618.exe	92
PID 3264 wrote to memory of 4760	3264	b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe	93
PID 3264 wrote to memory of 4760	3264	b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe	93
PID 3264 wrote to memory of 4760	3264	b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe	93
PID 4760 wrote to memory of 2164	4760	Unicorn-50449.exe	95
PID 4760 wrote to memory of 2164	4760	Unicorn-50449.exe	95
PID 4760 wrote to memory of 2164	4760	Unicorn-50449.exe	95
PID 3264 wrote to memory of 3688	3264	b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe	96
PID 3264 wrote to memory of 3688	3264	b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe	96
PID 3264 wrote to memory of 3688	3264	b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe	96
PID 2952 wrote to memory of 1868	2952	Unicorn-18618.exe	97
PID 2952 wrote to memory of 1868	2952	Unicorn-18618.exe	97
PID 2952 wrote to memory of 1868	2952	Unicorn-18618.exe	97
PID 3348 wrote to memory of 2188	3348	Unicorn-17030.exe	98
PID 3348 wrote to memory of 2188	3348	Unicorn-17030.exe	98
PID 3348 wrote to memory of 2188	3348	Unicorn-17030.exe	98
PID 2164 wrote to memory of 1172	2164	Unicorn-49230.exe	104
PID 2164 wrote to memory of 1172	2164	Unicorn-49230.exe	104
PID 2164 wrote to memory of 1172	2164	Unicorn-49230.exe	104
PID 4760 wrote to memory of 4852	4760	Unicorn-50449.exe	105
PID 4760 wrote to memory of 4852	4760	Unicorn-50449.exe	105
PID 4760 wrote to memory of 4852	4760	Unicorn-50449.exe	105
PID 2188 wrote to memory of 2272	2188	Unicorn-20450.exe	106
PID 2188 wrote to memory of 2272	2188	Unicorn-20450.exe	106
PID 2188 wrote to memory of 2272	2188	Unicorn-20450.exe	106
PID 1868 wrote to memory of 1944	1868	Unicorn-584.exe	108
PID 1868 wrote to memory of 1944	1868	Unicorn-584.exe	108
PID 1868 wrote to memory of 1944	1868	Unicorn-584.exe	108
PID 3348 wrote to memory of 4940	3348	Unicorn-17030.exe	107
PID 3348 wrote to memory of 4940	3348	Unicorn-17030.exe	107
PID 3348 wrote to memory of 4940	3348	Unicorn-17030.exe	107
PID 2952 wrote to memory of 5116	2952	Unicorn-18618.exe	109
PID 2952 wrote to memory of 5116	2952	Unicorn-18618.exe	109
PID 2952 wrote to memory of 5116	2952	Unicorn-18618.exe	109
PID 3264 wrote to memory of 4732	3264	b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe	110
PID 3264 wrote to memory of 4732	3264	b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe	110
PID 3264 wrote to memory of 4732	3264	b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe	110
PID 1172 wrote to memory of 3416	1172	Unicorn-59318.exe	111
PID 1172 wrote to memory of 3416	1172	Unicorn-59318.exe	111
PID 1172 wrote to memory of 3416	1172	Unicorn-59318.exe	111
PID 2164 wrote to memory of 3600	2164	Unicorn-49230.exe	112
PID 2164 wrote to memory of 3600	2164	Unicorn-49230.exe	112
PID 2164 wrote to memory of 3600	2164	Unicorn-49230.exe	112
PID 2272 wrote to memory of 3644	2272	Unicorn-52110.exe	113
PID 2272 wrote to memory of 3644	2272	Unicorn-52110.exe	113
PID 2272 wrote to memory of 3644	2272	Unicorn-52110.exe	113
PID 4940 wrote to memory of 4140	4940	Unicorn-24076.exe	114
PID 4940 wrote to memory of 4140	4940	Unicorn-24076.exe	114
PID 4940 wrote to memory of 4140	4940	Unicorn-24076.exe	114
PID 5116 wrote to memory of 1668	5116	Unicorn-33727.exe	115
PID 5116 wrote to memory of 1668	5116	Unicorn-33727.exe	115
PID 5116 wrote to memory of 1668	5116	Unicorn-33727.exe	115
PID 2952 wrote to memory of 2140	2952	Unicorn-18618.exe	116
PID 2952 wrote to memory of 2140	2952	Unicorn-18618.exe	116
PID 2952 wrote to memory of 2140	2952	Unicorn-18618.exe	116
PID 1944 wrote to memory of 3976	1944	Unicorn-43942.exe	117
PID 1944 wrote to memory of 3976	1944	Unicorn-43942.exe	117
PID 1944 wrote to memory of 3976	1944	Unicorn-43942.exe	117
PID 3348 wrote to memory of 2424	3348	Unicorn-17030.exe	118

C:\Users\Admin\AppData\Local\Temp\b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe
"C:\Users\Admin\AppData\Local\Temp\b7ac200562c286a15dd07751ef1469e73dabffa844d7d832c31b487ef644c78c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18618.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18618.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17030.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20450.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61150.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28006.exe
        8⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27570.exe
        9⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
        10⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55274.exe
        11⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1200.exe
        11⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
        11⤵
        
        PID:17588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24396.exe
        10⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        10⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        10⤵
        
        PID:17816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        10⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
        10⤵
        
        PID:18188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        9⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        10⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
        9⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43376.exe
        9⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exe
        9⤵
        
        PID:17692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        9⤵
        
        PID:18332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9396.exe
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        9⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        9⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        9⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        9⤵
        
        PID:18352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53789.exe
        9⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        8⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        8⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        7⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        8⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 628
        9⤵
        Program crash
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4779.exe
        8⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21324.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
        8⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        8⤵
        
        PID:17764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        8⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        8⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        8⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        8⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        7⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41824.exe
        7⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        7⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62982.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33089.exe
        7⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48426.exe
        7⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        8⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27210.exe
        10⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51465.exe
        10⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44529.exe
        10⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        9⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        9⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        9⤵
        
        PID:18292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22171.exe
        8⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
        8⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
        8⤵
        
        PID:18156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9012.exe
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        8⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64521.exe
        8⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
        8⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51847.exe
        8⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45620.exe
        7⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exe
        7⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
        7⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15123.exe
        7⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
        6⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36914.exe
        8⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56545.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
        8⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55438.exe
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36020.exe
        7⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        7⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe
        7⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50953.exe
        6⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49358.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        7⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27675.exe
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        7⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27466.exe
        6⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
        6⤵
        
        PID:17772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2438.exe
        6⤵
        
        PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2608.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38566.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61638.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        9⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42964.exe
        10⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51029.exe
        9⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        9⤵
        
        PID:17140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        8⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
        8⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
        8⤵
        
        PID:17424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2721.exe
        8⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
        7⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2949.exe
        8⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        8⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
        7⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        7⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        7⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55177.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        7⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24714.exe
        8⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        8⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25615.exe
        8⤵
        
        PID:18428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11271.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12056.exe
        7⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10079.exe
        7⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        6⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48922.exe
        7⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        7⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        6⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57401.exe
        6⤵
        
        PID:18080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48772.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31050.exe
        8⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        8⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe
        8⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
        7⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        7⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe
        7⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25296.exe
        6⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exe
        7⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        7⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49616.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        6⤵
        
        PID:13480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35857.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37829.exe
        5⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63662.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        7⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24832.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49789.exe
        7⤵
        
        PID:17412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        7⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3103.exe
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        6⤵
        
        PID:18336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        6⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        5⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe
        5⤵
        
        PID:14756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24076.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41306.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13257.exe
        9⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31486.exe
        10⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        10⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
        9⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exe
        9⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24709.exe
        9⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16176.exe
        8⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
        8⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        8⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        8⤵
        
        PID:18312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        8⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        8⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe
        8⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        8⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        7⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        7⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        7⤵
        
        PID:16204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        6⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52266.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        8⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22602.exe
        9⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17536.exe
        9⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59440.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:18420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
        9⤵
        
        PID:18284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48953.exe
        8⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38716.exe
        8⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38898.exe
        8⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27415.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
        7⤵
        
        PID:14460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24802.exe
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
        7⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        7⤵
        
        PID:17804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8781.exe
        7⤵
        
        PID:17988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45908.exe
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47836.exe
        6⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exe
        6⤵
        
        PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31898.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58322.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        8⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10717.exe
        9⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1724.exe
        9⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exe
        9⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47266.exe
        9⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38428.exe
        8⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42460.exe
        8⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46753.exe
        8⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        7⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
        7⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        6⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        8⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        7⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        7⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
        7⤵
        
        PID:16768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        7⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3811.exe
        6⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37542.exe
        7⤵
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
        7⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37012.exe
        7⤵
        
        PID:17520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exe
        7⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        6⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
        7⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
        7⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46264.exe
        7⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29386.exe
        7⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25215.exe
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56640.exe
        6⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exe
        5⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
        6⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8185.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        7⤵
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10868.exe
        6⤵
        
        PID:17960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37554.exe
        6⤵
        
        PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
        6⤵
        
        PID:16988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58287.exe
        6⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
        5⤵
        
        PID:11184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        5⤵
        
        PID:15148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        5⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53952.exe
        5⤵
        
        PID:17628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        5⤵
        
        PID:8628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16343.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58182.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21082.exe
        8⤵
        
        PID:16736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8017.exe
        8⤵
        
        PID:17964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48953.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38716.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46068.exe
        7⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
        6⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
        7⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
        6⤵
        
        PID:14432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22202.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        6⤵
        
        PID:16348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        6⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54762.exe
        5⤵
        
        PID:16036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41898.exe
        6⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        7⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2107.exe
        7⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        7⤵
        
        PID:18044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49721.exe
        6⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41657.exe
        6⤵
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
        6⤵
        
        PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28554.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43924.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        6⤵
        
        PID:17664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        6⤵
        
        PID:18288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
        5⤵
        
        PID:9836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        5⤵
        
        PID:14620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49601.exe
        5⤵
        
        PID:18168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16335.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
        5⤵
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exe
        6⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        6⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        6⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59897.exe
        5⤵
        
        PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        5⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13013.exe
        5⤵
        
        PID:17504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        5⤵
        
        PID:18196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
      4⤵
      PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51470.exe
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62644.exe
        5⤵
        
        PID:18008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
      4⤵
      PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
      4⤵
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27896.exe
      4⤵
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24637.exe
      4⤵
      PID:6560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57938.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        9⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exe
        9⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
        9⤵
        
        PID:17804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
        8⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        9⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        8⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        8⤵
        
        PID:18172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40090.exe
        8⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14796.exe
        8⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        8⤵
        
        PID:18020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62332.exe
        7⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11360.exe
        7⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25782.exe
        7⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9100.exe
        6⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5141.exe
        7⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
        8⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
        8⤵
        
        PID:18060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55716.exe
        7⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58989.exe
        7⤵
        
        PID:18240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        7⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13568.exe
        6⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2705.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51465.exe
        7⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41144.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26928.exe
        6⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
        6⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15393.exe
        6⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
        6⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5632 -s 720
        7⤵
        Program crash
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5260.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        6⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
        5⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9225.exe
        6⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39648.exe
        7⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
        7⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26575.exe
        7⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-520.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        6⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33541.exe
        6⤵
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50281.exe
        6⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31294.exe
        6⤵
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1688.exe
        6⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54477.exe
        6⤵
        
        PID:17852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10251.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
        5⤵
        
        PID:13576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
        5⤵
        
        PID:17276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15052.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26314.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
        7⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22202.exe
        8⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
        8⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
        8⤵
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        8⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
        7⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40541.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        7⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
        6⤵
        
        PID:13984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45056.exe
        6⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30149.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        6⤵
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        6⤵
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48666.exe
        6⤵
        
        PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
        5⤵
        
        PID:12728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        5⤵
        
        PID:17440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32627.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60818.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        7⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        7⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        7⤵
        
        PID:18208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
        6⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        7⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        7⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        6⤵
        
        PID:12000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exe
        6⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        6⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47113.exe
        5⤵
        
        PID:364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
        6⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
        6⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7048.exe
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26935.exe
        5⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        5⤵
        
        PID:17796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57209.exe
        5⤵
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
      4⤵
      PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
        5⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62897.exe
        5⤵
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9741.exe
        5⤵
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58381.exe
      4⤵
      PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30102.exe
      4⤵
      PID:9848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30927.exe
      4⤵
      PID:16216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27756.exe
      4⤵
      PID:17764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
      4⤵
      PID:2392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42894.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37414.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
        7⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57998.exe
        8⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16332.exe
        8⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        8⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        8⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        7⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        7⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
        7⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15206.exe
        7⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23760.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        7⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65200.exe
        7⤵
        
        PID:15960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exe
        6⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        6⤵
        
        PID:17560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16692.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11425.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20158.exe
        8⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59757.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exe
        7⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64345.exe
        7⤵
        
        PID:18388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
        7⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19440.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9121.exe
        6⤵
        
        PID:17584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31294.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        6⤵
        
        PID:16336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        5⤵
        
        PID:9744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        5⤵
        
        PID:13136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2733.exe
        5⤵
        
        PID:17912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-569.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56070.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55274.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37956.exe
        7⤵
        
        PID:14672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        7⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        7⤵
        
        PID:18300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56596.exe
        6⤵
        
        PID:13440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35845.exe
        6⤵
        
        PID:17116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
        6⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22020.exe
        6⤵
        
        PID:17536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        6⤵
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5267.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        5⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2203.exe
        5⤵
        
        PID:17972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        5⤵
        
        PID:18048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55508.exe
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24794.exe
        5⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        6⤵
        
        PID:10928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2107.exe
        6⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
        6⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31884.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        5⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        5⤵
        
        PID:17880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1182.exe
        5⤵
        
        PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
      4⤵
      PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        5⤵
        
        PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15704.exe
        5⤵
        
        PID:12968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65200.exe
        5⤵
        
        PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
      4⤵
      PID:8560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
      4⤵
      PID:12768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
      4⤵
      PID:17432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-657.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9225.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
        7⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35774.exe
        7⤵
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
        6⤵
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        6⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        6⤵
        
        PID:15644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57201.exe
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        6⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        6⤵
        
        PID:17672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
        5⤵
        
        PID:9856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        5⤵
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        5⤵
        
        PID:17300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51470.exe
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        6⤵
        
        PID:17896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe
        6⤵
        
        PID:16932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        5⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        5⤵
        
        PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40568.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16058.exe
        5⤵
        
        PID:9592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        5⤵
        
        PID:13644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
      4⤵
      PID:10380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
      4⤵
      PID:15428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25974.exe
      4⤵
      PID:1264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
      4⤵
      PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25370.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42424.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59440.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        6⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25216.exe
        5⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        5⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        5⤵
        
        PID:16480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48457.exe
      4⤵
      PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12269.exe
        5⤵
        
        PID:10960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15859.exe
        5⤵
        
        PID:18060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
      4⤵
      PID:9864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
      4⤵
      PID:13496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      4⤵
      PID:17224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36158.exe
      4⤵
      PID:8112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exe
    3⤵
    PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48478.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        5⤵
        
        PID:10500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        5⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7712.exe
        5⤵
        
        PID:18104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
      4⤵
      PID:9800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
      4⤵
      PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
      4⤵
      PID:17216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
    3⤵
    PID:7960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31435.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
    3⤵
    PID:14740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
    3⤵
    PID:3436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50449.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50449.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49230.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59318.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41742.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14601.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        9⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
        10⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44966.exe
        10⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        9⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        9⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        9⤵
        
        PID:17252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        9⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
        8⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        9⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2589.exe
        9⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18287.exe
        8⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        8⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        7⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        8⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
        9⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        9⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19020.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40568.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24236.exe
        7⤵
        
        PID:17636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58322.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39158.exe
        8⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20334.exe
        9⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exe
        9⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41377.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11604.exe
        9⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3400.exe
        8⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
        8⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        8⤵
        
        PID:17240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        8⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
        7⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        7⤵
        
        PID:17836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55585.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20359.exe
        7⤵
        
        PID:18344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
        6⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40886.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        8⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
        8⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44661.exe
        8⤵
        
        PID:17960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36944.exe
        7⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
        7⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24615.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        6⤵
        
        PID:11988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        6⤵
        
        PID:15940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51119.exe
        6⤵
        
        PID:17700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29608.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28006.exe
        6⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31846.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
        9⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        9⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
        8⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        8⤵
        
        PID:14268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44765.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
        7⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
        7⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9795.exe
        7⤵
        
        PID:17944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exe
        7⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4412.exe
        7⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        7⤵
        
        PID:16572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
        7⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        6⤵
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54085.exe
        6⤵
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54620.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9623.exe
        5⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26832.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30572.exe
        8⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe
        7⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64381.exe
        7⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        7⤵
        
        PID:17896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35000.exe
        6⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57386.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        7⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
        7⤵
        
        PID:17816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55201.exe
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        6⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        6⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52385.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18118.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        6⤵
        
        PID:16192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        6⤵
        
        PID:18100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5295.exe
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13036.exe
        5⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52458.exe
        5⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45504.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29712.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22882.exe
        8⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        8⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57591.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
        7⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
        7⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13567.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
        7⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
        7⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        6⤵
        
        PID:13448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
        6⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32041.exe
        7⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
        7⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17328.exe
        7⤵
        
        PID:17936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        7⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        6⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40900.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        7⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        7⤵
        
        PID:18404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29247.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        6⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        5⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24802.exe
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
        6⤵
        
        PID:14284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        6⤵
        
        PID:17784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        6⤵
        
        PID:18112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        5⤵
        
        PID:11768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34430.exe
        5⤵
        
        PID:14648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34970.exe
        6⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24994.exe
        8⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        8⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
        7⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        7⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4288.exe
        7⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        7⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34808.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51496.exe
        6⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3044.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        6⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24138.exe
        7⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        7⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        7⤵
        
        PID:17892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57172.exe
        6⤵
        
        PID:14116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24901.exe
        6⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9299.exe
        5⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25881.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27895.exe
        5⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10748.exe
        5⤵
        
        PID:18304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64305.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28530.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        7⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        7⤵
        
        PID:15512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
        6⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15616.exe
        6⤵
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        6⤵
        
        PID:17844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe
        5⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37454.exe
        6⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
        6⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        5⤵
        
        PID:10484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24501.exe
        5⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        5⤵
        
        PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
      4⤵
      PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15393.exe
        5⤵
        
        PID:11776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe
        5⤵
        
        PID:15076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
        5⤵
        
        PID:17948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4240.exe
      4⤵
      PID:404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44082.exe
      4⤵
      PID:11168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
      4⤵
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
      4⤵
      PID:7236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4912.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56402.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33870.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        8⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18896.exe
        8⤵
        
        PID:17508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41692.exe
        7⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        7⤵
        
        PID:13960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
        7⤵
        
        PID:18176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44765.exe
        6⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
        7⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
        7⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
        6⤵
        
        PID:17932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45383.exe
        6⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-931.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22602.exe
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1200.exe
        6⤵
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6539.exe
        6⤵
        
        PID:17420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
        6⤵
        
        PID:18096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
        5⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56728.exe
        5⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48900.exe
        5⤵
        
        PID:17176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16275.exe
        5⤵
        
        PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54548.exe
      4⤵
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65286.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
        6⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        6⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
        6⤵
        
        PID:17632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18480.exe
        5⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50104.exe
        5⤵
        
        PID:12060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18600.exe
        5⤵
        
        PID:14644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29927.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        5⤵
        
        PID:17736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
      4⤵
      PID:8444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
      4⤵
      PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe
      4⤵
      PID:8316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28787.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5701.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12223.exe
        5⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53801.exe
        5⤵
        
        PID:18084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18228.exe
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
        6⤵
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60975.exe
        6⤵
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19020.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
      4⤵
      PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15061.exe
        5⤵
        
        PID:12944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22020.exe
        5⤵
        
        PID:17480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        5⤵
        
        PID:18128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
      4⤵
      PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
      4⤵
      PID:15476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
      4⤵
      PID:3088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
      4⤵
      PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30606.exe
        5⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49721.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
        5⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
        5⤵
        
        PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
      4⤵
      PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        5⤵
        
        PID:12232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe
        5⤵
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
      4⤵
      PID:9672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33297.exe
      4⤵
      PID:13648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      4⤵
      PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7378.exe
      4⤵
      PID:3660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
    3⤵
    PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
      4⤵
      PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exe
        5⤵
        
        PID:14516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45705.exe
        5⤵
        
        PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
        5⤵
        
        PID:18012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
      4⤵
      PID:9012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36944.exe
      4⤵
      PID:14160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
      4⤵
      PID:16916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
    3⤵
    PID:7416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35394.exe
      4⤵
      PID:15144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
    3⤵
    PID:10964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43843.exe
    3⤵
    PID:14388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4218.exe
    3⤵
    PID:13276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34931.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34931.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 480
    3⤵
    - Program crash
    PID:2592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45582.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23870.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57017.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27210.exe
        8⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        8⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
        7⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9795.exe
        7⤵
        
        PID:17936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        7⤵
        
        PID:18208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exe
        6⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39668.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
        6⤵
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20686.exe
        6⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19100.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        6⤵
        
        PID:12744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45538.exe
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23575.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52217.exe
        5⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54232.exe
        5⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
      4⤵
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11425.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        6⤵
        
        PID:16184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27670.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63981.exe
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        5⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        5⤵
        
        PID:18048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
      4⤵
      PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38730.exe
        5⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21746.exe
        6⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40414.exe
        6⤵
        
        PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        5⤵
        
        PID:16156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        5⤵
        
        PID:17976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20120.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
      4⤵
      PID:12840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45864.exe
      4⤵
      PID:16540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18606.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
        6⤵
        
        PID:13864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9559.exe
        6⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53191.exe
        6⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-520.exe
        5⤵
        
        PID:8536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        5⤵
        
        PID:12848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53509.exe
        5⤵
        
        PID:17568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        5⤵
        
        PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
      4⤵
      PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        5⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48666.exe
        5⤵
        
        PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
      4⤵
      PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
      4⤵
      PID:13536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      4⤵
      PID:17316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34511.exe
    3⤵
    PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
      4⤵
      PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        5⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        6⤵
        
        PID:11948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21148.exe
        6⤵
        
        PID:17496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
        6⤵
        
        PID:17784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        5⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12735.exe
        5⤵
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        5⤵
        
        PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
      4⤵
      PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60593.exe
      4⤵
      PID:16168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
      4⤵
      PID:16304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64747.exe
      4⤵
      PID:7140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43361.exe
    3⤵
    PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
      4⤵
      PID:10548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
      4⤵
      PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
      4⤵
      PID:18152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
    3⤵
    PID:8468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23124.exe
    3⤵
    PID:12828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38618.exe
    3⤵
    PID:16608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exe
    3⤵
    PID:7224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25987.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25987.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
      4⤵
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        5⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31294.exe
        6⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        6⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        5⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41657.exe
        5⤵
        
        PID:13904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
        5⤵
        
        PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        5⤵
        
        PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
      4⤵
      PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
        5⤵
        
        PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        5⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36088.exe
        5⤵
        
        PID:18080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
      4⤵
      PID:13512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      4⤵
      PID:17160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
    3⤵
    PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
      4⤵
      PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4765.exe
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
        5⤵
        
        PID:15172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30083.exe
        5⤵
        
        PID:18348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        5⤵
        
        PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exe
      4⤵
      PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
      4⤵
      PID:12548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
      4⤵
      PID:16588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34321.exe
      4⤵
      PID:6416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
    3⤵
    PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36094.exe
      4⤵
      PID:9788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
      4⤵
      PID:14328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41646.exe
      4⤵
      PID:2368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
    3⤵
    PID:8492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43552.exe
    3⤵
    PID:10260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
    3⤵
    PID:16464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20308.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20308.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
    3⤵
    PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
      4⤵
      PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        5⤵
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        5⤵
        
        PID:11196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        5⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20156.exe
        5⤵
        
        PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46213.exe
      4⤵
      PID:7588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37608.exe
      4⤵
      PID:13016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5528.exe
      4⤵
      PID:16512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
    3⤵
    PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
      4⤵
      PID:12588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
      4⤵
      PID:15920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
      4⤵
      PID:3528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
    3⤵
    PID:9896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
    3⤵
    PID:13544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
    3⤵
    PID:17308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
  2⤵
  PID:5776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
    3⤵
    PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
      4⤵
      PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20748.exe
      4⤵
      PID:13028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52948.exe
      4⤵
      PID:16432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
      4⤵
      PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49721.exe
    3⤵
    PID:8548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
    3⤵
    PID:15412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
    3⤵
    PID:18024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55303.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55303.exe
  2⤵
  PID:6684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
    3⤵
    PID:10336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
    3⤵
    PID:14340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
  2⤵
  PID:9872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63949.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63949.exe
  2⤵
  PID:13596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
  2⤵
  PID:17260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3688 -ip 3688
1⤵
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5632 -ip 5632
1⤵
PID:6704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6552 -ip 6552
1⤵
PID:9108

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1020 -s 2816
1⤵
PID:17536

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:17656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6196 -ip 6196
1⤵
PID:6984

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:8056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-15052.exe

Filesize
468KB

MD5
05c2f245794d33d09a816ca0b1dc344c

SHA1
a53a6c23789131e62ef3deac5943e8f6e9de67b2

SHA256
d71f239a6da23a257734e9bc80f425092117c04d79585a3928c4e2b374e20b60

SHA512
dcc6ba9985e053764ce0d470c2db04ac24e11b7d2ff1af93c0fa1a62f8a0d0042dd09cd029b926aaabc36753d6dcdfaea7ada2e88e0a3451e416971dfca39222

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16343.exe

Filesize
468KB

MD5
5706abfd4e88584ad1ad7c9fc77090d5

SHA1
62cbdb126e9e3532d37591733bed4258ae9f0745

SHA256
43232633eb1e689816b9ecfba859b9ecff19b79354bcc2fe838aa207fed95626

SHA512
73486bd8984d103ff25e1bdd11f0d77263804bf1bcf23367850ddde208b76fb3bc22a73a2bfe4c25a0bb5558d79643a6c9d2d8658b698ac1732bb4e621af5c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17030.exe

Filesize
468KB

MD5
cf3020b4418e308a1897e75db2d6c5b8

SHA1
d119ac514e790609932f8c24e3672a9208d7161c

SHA256
ad995c682292b7d9c7341cedb68aebf8f1421655e0417e0c5a9ae0fdc3f342f2

SHA512
1d789c844f98d1900ffc481110e570eb3910c67e9a603db4cf618e0e2eaed3c04ebb3e95bc666e06c78033036db1409d3165465e1d87c75ecd02da639328c6ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe

Filesize
468KB

MD5
1e8cdb128a06cd3e3623c3463c6c4873

SHA1
ffb21a6a32d0ea29e9022453c70a793a4092c4e8

SHA256
d4b681e1bba87a9967ac405e371437ec258e2eff9ead95445fc32fc6af087a06

SHA512
19be19f49fc3167f7fedc2ebb2402fc59408288b1785bc67f5893685f401cb4b668c0599e386d14f7b73b578d6bda52c0b4408749caea0a024c5221355e810a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe

Filesize
468KB

MD5
5f62df5158c11456e85a853712097a23

SHA1
f7732ef14ed20ed1fd0c0d44d10d8598fcec8d17

SHA256
964f65303bf81e4e34ddb6698779b059b4facf097c58c4205f155e6301e6a4b4

SHA512
233cef0b77d13454e0fba82af0757a860537a8715bbe45d3dd76cb2312ee1178fb9af0bcfffb94c7ea533e5f19b736771e4efa85d1e301f593506837286b2d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18618.exe

Filesize
468KB

MD5
20a21bc127a0bdc92a660e47e1d85a82

SHA1
8e998fa7f56a78bce495366d7efdfb0ce35ac176

SHA256
48748b9ed30613f3e524458baa870fd6d6aff53a98205bd3b2b529d4323376e3

SHA512
7e0cc76cacb3cd95c303335766d811fb735f18b45303ab59d3210a82ad5ea5a3b4e00acd7c6d55c1b6e0c9757705aaba91b7d3e408f4466e91c352f3aa7a17c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20450.exe

Filesize
468KB

MD5
d3c920ae45f6dfa706468c31448290c6

SHA1
103d875c4777beab44d781be66d4ff1de7152375

SHA256
2f0ab206156d596cc96320af9b054e539e28bd162123af57bd267caa56566a88

SHA512
6f6b047e58ffa04511aae76339d27a95f6a71140aa1a7c71f56c455217bf122e045add3ed4f7ea06dc0ac9575a74f64a3439fd77e3b507b69e880000f5e95d0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe

Filesize
468KB

MD5
2236f7a208be95e3bb48618df8027a9b

SHA1
655ce0cca00a3baf7e5fc8b9e83b7593a823a3c4

SHA256
5f21547c760f09669ee8f8de2ba2b1e8aba00cfb0db8b13d0ab69e1037795367

SHA512
b11baffab7c81a4e091b716affb82823f9f39d9c061dbf4b8aa6052f34e1ec48dd80c855ec7edbfc18ff5aab25a70c3fed3d54a88ba09265903d15a897865d48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe

Filesize
468KB

MD5
e7bdd94b628a650fea7f77fd3568beb9

SHA1
8fd482393814754082fc20437c020a0ec2775c9d

SHA256
50c5e4bd1a141f256522ca250b622e68ef749ea9df64a86e151ed947a615fff2

SHA512
482ee6eff6fa3492c92adbf5b37ffb3e7a38a294abb93e2e5e7305f3bfb50ab7fec77d57ff2e30d6e3a1f31663067bd3bb1af6353e141f5c53d66e78a6124dd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe

Filesize
468KB

MD5
411128d9219739e00ba602672752aed1

SHA1
65caf0d5b85fd2e1b0d49368a90893e018d60a0f

SHA256
c4e137d399e357f18f81935b3f79edf89a5a901500eb24ed8a1cc910791a8abc

SHA512
aaeb7153cdfee8e3d05571363a87887c4b6b5fdfc900db37c9c5a3b698c3c9ef9d988c30c991033dca87256c6e859a8c043f86e71158356d1a50c80ce623c7ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24076.exe

Filesize
468KB

MD5
ba793a5d82d0bd864129440f0ff6623c

SHA1
3642a8bc7e7373818811928845caa7ebce06f5f2

SHA256
3c9c54a8e3715ebf05f4e6f579aa43ba193121550f2b8e508bbab328f6dae2a5

SHA512
dee0366ac0025e9b9f1235508d46a3bf0c35df07e7e701a4c2967d59d00d8eaae0fbb0cb0ba4ea88c0e3cbcd61403ebf8fb6b62452e4d18dc260d1e47f1ceddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25987.exe

Filesize
468KB

MD5
5411e046578ba62f489aebcce97b8883

SHA1
c9cf213479d165af1c7b81aee2b201e28f391a0f

SHA256
2f430f4b67365e27e2129a1a099744bc4a698b1f639b5e82ea551281a8229c29

SHA512
82ae5315bd2b19bcc9af10ca5eef030eeb260f841ad49ac44a16e10d08fac43c13407c82c83143e2e8fc4b2a6e2e3c81dc3f3e2ea0519eba70f770fc2fa8eedc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2608.exe

Filesize
468KB

MD5
3104505604c672347b23380cb4675c80

SHA1
3794ed16734686d80acc3e659c606764a89dc98e

SHA256
54ed6c34d2dade6177b1f70769104fd0b9975727ad40d836a28faa02f40e5383

SHA512
c8215f674b01c0ac7919d02f6c68f646f92bccb3c2670437b156b5ca025dd6f669ae5b1e6a24ecfd194182aadfa34a76a21bce757ffbb32dd624e77a8f8e255c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe

Filesize
468KB

MD5
d229206b76d8108f5a38c037b5c5b2e3

SHA1
6fff25d3770dc79d928136c7045ad30761f6af46

SHA256
d89f75615dcc5da464132f4dbf93c27811b14c82da8e93c91a9eb1fe8459b099

SHA512
9fb04d0dd7374b2cd21bf2d354a07a9c81e2da8d845d604d0b770c1a50b5722364862daac88ec914b9ff46ca9a719717fb23ffebd0a6e81070f96a363355f381

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28787.exe

Filesize
468KB

MD5
eef1114e435e6ab3940ada3847d9162e

SHA1
26c859145a52bc4641c049d0f4c93e9def89767c

SHA256
bf95ca09b9b4914cacb6d39381d33c49b7fa1f75938f9a3ba6346953c6c51419

SHA512
94e91faae72ef3addcfc222120617a56fdd425562a6c2b0e817a744a51f5ed94c9967572ab43a57baab66ea00b2150419ba63f68ceab765a2a5956d38cead922

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29608.exe

Filesize
468KB

MD5
33196a5fdcac91523776f9a0b83b45f6

SHA1
6b5b92310091cda3d47c4a10e25763fd0ec8aac4

SHA256
b9c5ec50d9a3cfb430cbde609ac5dc20c56410b9141fc03019733441c03e3be3

SHA512
ba9c7774d6586e5750921a93c9d7ffe02f6471fb9411bff5b4e942a520f7f54128210a22d508e444f48f2e9cac2f488338fdc81ec3054405c922cb8bbc9acbd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe

Filesize
468KB

MD5
29c7cce297cac513786d8f464663ea8f

SHA1
f2dd1f3f618c8c79e11caf54ab1dd5ac27c5a5ac

SHA256
842605a58a62e6989a2a4606c51947f9f23081e4814dc1248503e6c101ccbfd0

SHA512
82fc47f24c7516b1ef47a7d0b70edd55b03f7753b59da4828c1ddc993b44fbebf20278d9a105cced9add9cbe5dec36343597b12aa8e492d5ce631b9c2f734e41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe

Filesize
468KB

MD5
dd6ab26a3c3d4566a7a73af7a9cba18a

SHA1
67aae1bde501479f03097c70ea7d8f27faf44472

SHA256
26874dbbad6fa5762186239a003d22f69ffe2765cb6e9f03da8bfdb1b176a394

SHA512
23af4208280cb1035e908fdf7828a5452f18808709427dea632565543b9ac6d3ba127575ecdf7ce489c42539a0e6e96c39c61834a86c7d22aadb8ccdca7bea5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34931.exe

Filesize
468KB

MD5
9945efd5450b5539b0eb3202e9fc3a6b

SHA1
e5e9377d83356150a01a40896facae2d3023a4be

SHA256
70c6f1a6baad8455a6b2ff56dab4680b466a61f5c1f5c7770fc629b0908b4d34

SHA512
7cfb5be57294420ccf07ad1b3bc42eee8733bd17f41fa0af1a3a196c20619b7626edb4444d3e2a129ce121fa2f18201a9481c2ec64db8483cbb65b531a6c4edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41742.exe

Filesize
468KB

MD5
160039cf6db657cf4769e0ecb86771ed

SHA1
475d74312fd4f227ce877ed421ebd44a98e3eef0

SHA256
9b7cd3cae9d028a9468b8fbd78d69c718366cd3f441153b0defd6b3753e51bf9

SHA512
85f4f0e7db1fe03daefa3582523b43e5be97ba45023e296d73c86b8923fd756f5c5186cb91bf65183b73321b8f8ce16c9e80fe577398f7045f10287858015e70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42894.exe

Filesize
468KB

MD5
0d07c19c09791cd395ff98f6acd89b7c

SHA1
96aec39743d00cc74ef226a016887a5ccc55d557

SHA256
77e50db7f5d4a5a178c26c1b678f4cba23017285eee2ef92b96a5f92c8f03baf

SHA512
0901fba5a9063cf304a101b7d2d6011ef0cdbfe9dbf4ce8f6c1f105166b3460bc0f408c5215580dc44fa7fff14937e013a419935635a7a211d478e74c3a0719c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe

Filesize
468KB

MD5
0ba787790bf83304a86e283dbc7fb47e

SHA1
ba5574794110ed301871f6f0064ebdc4706efa57

SHA256
ea43913e33136cf0e80190101aa078ee2f51ffd8d3e1383e6cddaac33c41bc62

SHA512
9f4053ce6db2cc059586142d1ddc41162af050140b9f9dbb1e1665a0ed7a9395056479afd30315630f52c099a5656da3dd29880287999d3d05b3275386000a4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe

Filesize
468KB

MD5
5136d31fcc5c3aedd5b08c425175084f

SHA1
c8b7c88da5ea2e47776a6f87c08423adce488f31

SHA256
b06202437718981e1b8e5f58d2abd307f5f3170a3a4dae0145a6544b3b66d817

SHA512
14096a4cd4b0f405d14e96b9b19eec38df9ed62bdb2fc552e3fb5b2b2616f148c3ebd7374791d300fce8c48ad50adf7b70390357ae1c931812ffc57ad8c6c86c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe

Filesize
468KB

MD5
028786d18b58363eadeab920c2bec4a5

SHA1
25713b30a8a4df3c8c9a888a1b7fe2d1e0350e42

SHA256
dd53a1a68c8d64d73794fa742ffc88a96c46b94a10da36c5bd0257842de53f82

SHA512
af39e53ece7fbff2e2c30508ccfc1476b5ec9dd12554498d0ec6f32c131ad0271f8a1248174dde319510176365b5f76b12c508cf895c1bf219af390a16000c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45504.exe

Filesize
468KB

MD5
820d15f93d8baaf478b88b4309e6af40

SHA1
6687bbbec3536bef58d050c2bd55df5f572fb914

SHA256
67161ba3b684006757d66df6e5f5284c40871253db40342033dcf52c4cc22eb8

SHA512
ce06dcfbf7e171fa59fbe0ac9e9d68fb18e9d3c3c69925397734bc46084e8f1e4b315ceb9fc8d03dd10bccb8e1f92e31c5fb88648fe744b53ab2a0dfd4ca0e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4912.exe

Filesize
468KB

MD5
efe858f9ea66dd1345d16138cdf0c73c

SHA1
07ef7043723b785ef5e7348541846d3ef0524ba0

SHA256
3791c8021db4b31db347200f6fb0e73831d4af1167d979412ea6b5bebc0432e7

SHA512
db6c6c8109adf5d9cbe77961d21211c7f447dfc7c52036d66b45c81775d7f0d1225c74977d0d27925f366065e199db05e7d89d97ce01213da0502d461d6f1fab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49230.exe

Filesize
468KB

MD5
56101fa93394336b8a4f37218c81fb1b

SHA1
b8262391f456f1b1876343d64b6dff769d2da148

SHA256
7327f999ffe2ed58370186f5abd1d4ee6fe8289e982972ea2086ccb5f2167f16

SHA512
14f95f4a71b95e142df8d4e3e53938e8b47500ac9914529563ba44bbe5cf9ee13eaf2ea204cfa579109ee36b13cdc2f1b9c351772ba827efc78e6b811c777bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50449.exe

Filesize
468KB

MD5
d75bf3754cdfe26c61e743bf567bc0dd

SHA1
04d1ae103a462867b58b94fb18183288b5476e3d

SHA256
7ae7d9792d42db1b3a2d5f0674afb0babad52377842726dd5319b37270e917d4

SHA512
597a3f0cd8b61a9331ba62e7a665454c1a526433c4dd9f9427c00ab3c842da480bf36555fb950cf7ffa298f946d3fed4fa7491243914cf4ff46204c5d53c907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe

Filesize
468KB

MD5
eefc794a1157e0d47405b783f25b17a8

SHA1
b236473d2c9adc95ccd38a48e94ec611717f1940

SHA256
9c2be6d3d37f67c1c83df45e3fad8d8bd1fa42bba5c7ce4a722f74ed4f6e03f6

SHA512
74559b6a8a1c2061585dc661198a1e7c5b72e7c69f7355b03e783d44dd44df9b19282177121e7cec1693999afff2e9a939a7fc11e19f4d6d6bfab235dedd5160

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe

Filesize
468KB

MD5
609fcc47797ac6506e7de9655d4a0f96

SHA1
7f4c6e886ef886922ffd818918703e00358f3227

SHA256
ef0a1f8f92757ffa16684f703a2706c16b4adf84c68b90a69d35f85078b351ca

SHA512
6c3122a74a36fffbe06406eb999f6de56aee640a673ba87594fce86a9e3fa33cfa7c1d5e96a713763c6040ec530aaaa7e8e2a4bc0608be1f3204985376493240

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59318.exe

Filesize
468KB

MD5
3c70d0aa1744f9e085655210b6a4efd2

SHA1
6196f17251689653e7360c99feaaf7cb8b571633

SHA256
ef1eaf5ce1ce1a312f09e6a8aa3102439fb5273bfd7bf63f6c357a1e9af321b3

SHA512
e34b4b2f7d15b619b74b7f8d2fdc2154cda8a47338fc7611f00cc22316410fc4ef414d82a2a2e846dff19a4becec5345c8d8927d766dc3a5c478a061434bc42b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62949.exe

Filesize
468KB

MD5
d63502a34b7bd06c69f855a837b7cf5f

SHA1
586d11ee44bdd37467413ad60e60b69b045cbd09

SHA256
ff879da69448707763abec3e838efac4608ba8247e5dd22571e102057d3f974d

SHA512
3b77ec4e6174f6620a51b5d0a320978d88e9ac90cd8c24b94a2545a89f3031d90ca4da7082b87c82631b8b0a98a76e4ce4e88438664c3457d65f44e628547565

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe

Filesize
468KB

MD5
eff049d583d29f495eda980d099f460a

SHA1
5c0d1e428f7e81f27578f753bf1b99a62da86af3

SHA256
f4270b4c8f26c0b2d8fae01ef05294bc730c41b36d63e962b4f716dcd3a7d945

SHA512
b9cfcf2b789286491a8e5cee63697e1c35d22b75faf061a556ec643d7e87926cbd10681c580dda19b38fc6ff8cba74da2c1b39695694ae77a53b8292762bb327

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe

Filesize
468KB

MD5
3ef185456acf0142fe7294475f98f0b6

SHA1
ce74ce37d6575b8edab07d93039312bec416c147

SHA256
b8c7d7fbc9fde2fa45f5c9f93168399b1bf5686a839260882e14baac45424d5e

SHA512
e45afa1aedb78d2fc4b556b6242ea4dda574b641cbea11ff5f33714d36e4bf12c8b181258e42673bb21c43a708958138b68ab8248673c271f8a6b33c98092155

Download Submit
memory/3600-3001-0x00000000761F0000-0x000000007624F000-memory.dmp

Filesize
380KB

Download
memory/3644-3003-0x0000000074EA0000-0x0000000074EC9000-memory.dmp

Filesize
164KB

Download
memory/3660-3495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/18128-3494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads