f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe
Size

468KB
MD5

84621034d4253530ef489a14a04d5ffe
SHA1

aaef004c9946829d667dd0e277f20cf9a48cad9f
SHA256

f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7
SHA512

962d0e89c3535457e230ed89103d4e955ef2adee3cdb45a7063e1a8b748c2cec33c7aff87bf50abb730bc41da4f09091bfd549823d80058338bddda87bc6d128
SSDEEP

3072:IbelogAaIa57tbYZPzcfmbfD/n2DnsIH9QJyAQVqYfoekyi2uxCl3:Ib4ore7tCP4fmbfraAIfovJ2ux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
436	Unicorn-9572.exe
3456	Unicorn-64284.exe
2508	Unicorn-49188.exe
756	Unicorn-30481.exe
2196	Unicorn-51648.exe
3172	Unicorn-60413.exe
2420	Unicorn-62451.exe
1304	Unicorn-58441.exe
532	Unicorn-50828.exe
3476	Unicorn-33937.exe
3152	Unicorn-21685.exe
1944	Unicorn-62068.exe
2496	Unicorn-1819.exe
4980	Unicorn-15554.exe
860	Unicorn-4087.exe
1428	Unicorn-31929.exe
2780	Unicorn-44928.exe
2788	Unicorn-31737.exe
1068	Unicorn-58471.exe
3272	Unicorn-61477.exe
3588	Unicorn-26758.exe
556	Unicorn-45141.exe
1540	Unicorn-4855.exe
2200	Unicorn-4300.exe
4612	Unicorn-4300.exe
3508	Unicorn-8384.exe
1148	Unicorn-45696.exe
4628	Unicorn-56631.exe
1180	Unicorn-65296.exe
3320	Unicorn-58737.exe
544	Unicorn-36271.exe
1792	Unicorn-1560.exe
4780	Unicorn-55400.exe
2900	Unicorn-1368.exe
3868	Unicorn-55805.exe
3236	Unicorn-37423.exe
1692	Unicorn-23687.exe
4520	Unicorn-27217.exe
3464	Unicorn-6531.exe
4600	Unicorn-47061.exe
2280	Unicorn-40791.exe
812	Unicorn-23709.exe
3168	Unicorn-56189.exe
3892	Unicorn-56189.exe
2532	Unicorn-35504.exe
400	Unicorn-23517.exe
1648	Unicorn-52852.exe
4920	Unicorn-1050.exe
2620	Unicorn-1050.exe
3988	Unicorn-11264.exe
4752	Unicorn-32047.exe
2880	Unicorn-64165.exe
3164	Unicorn-35577.exe
2300	Unicorn-23325.exe
5044	Unicorn-18478.exe
1812	Unicorn-3459.exe
4924	Unicorn-19241.exe
1228	Unicorn-48576.exe
2648	Unicorn-1943.exe
4140	Unicorn-3672.exe
2020	Unicorn-740.exe
3740	Unicorn-49941.exe
928	Unicorn-49941.exe
924	Unicorn-13739.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
7924	5896	WerFault.exe	238
15232	7300	WerFault.exe	317
16580	16400	WerFault.exe	849
19948	19048	Process not Found	1332

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43587.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4996	dwm.exe
Token: SeChangeNotifyPrivilege	4996	dwm.exe
Token: 33	4996	dwm.exe
Token: SeIncBasePriorityPrivilege	4996	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1520	f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe
436	Unicorn-9572.exe
3456	Unicorn-64284.exe
2508	Unicorn-49188.exe
756	Unicorn-30481.exe
2196	Unicorn-51648.exe
3172	Unicorn-60413.exe
2420	Unicorn-62451.exe
1304	Unicorn-58441.exe
532	Unicorn-50828.exe
3476	Unicorn-33937.exe
1944	Unicorn-62068.exe
3152	Unicorn-21685.exe
2496	Unicorn-1819.exe
4980	Unicorn-15554.exe
860	Unicorn-4087.exe
1428	Unicorn-31929.exe
2780	Unicorn-44928.exe
2788	Unicorn-31737.exe
1068	Unicorn-58471.exe
3272	Unicorn-61477.exe
3588	Unicorn-26758.exe
556	Unicorn-45141.exe
2200	Unicorn-4300.exe
1540	Unicorn-4855.exe
3508	Unicorn-8384.exe
4612	Unicorn-4300.exe
1180	Unicorn-65296.exe
1148	Unicorn-45696.exe
4628	Unicorn-56631.exe
3320	Unicorn-58737.exe
544	Unicorn-36271.exe
1792	Unicorn-1560.exe
4780	Unicorn-55400.exe
2900	Unicorn-1368.exe
3868	Unicorn-55805.exe
1692	Unicorn-23687.exe
4520	Unicorn-27217.exe
3236	Unicorn-37423.exe
3464	Unicorn-6531.exe
4600	Unicorn-47061.exe
2280	Unicorn-40791.exe
812	Unicorn-23709.exe
3892	Unicorn-56189.exe
3168	Unicorn-56189.exe
2532	Unicorn-35504.exe
400	Unicorn-23517.exe
1648	Unicorn-52852.exe
4920	Unicorn-1050.exe
3988	Unicorn-11264.exe
2620	Unicorn-1050.exe
2880	Unicorn-64165.exe
4752	Unicorn-32047.exe
3164	Unicorn-35577.exe
2300	Unicorn-23325.exe
1812	Unicorn-3459.exe
5044	Unicorn-18478.exe
4924	Unicorn-19241.exe
1228	Unicorn-48576.exe
2648	Unicorn-1943.exe
4140	Unicorn-3672.exe
2020	Unicorn-740.exe
3740	Unicorn-49941.exe
924	Unicorn-13739.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 436	1520	f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe	82
PID 1520 wrote to memory of 436	1520	f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe	82
PID 1520 wrote to memory of 436	1520	f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe	82
PID 436 wrote to memory of 3456	436	Unicorn-9572.exe	87
PID 436 wrote to memory of 3456	436	Unicorn-9572.exe	87
PID 436 wrote to memory of 3456	436	Unicorn-9572.exe	87
PID 1520 wrote to memory of 2508	1520	f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe	88
PID 1520 wrote to memory of 2508	1520	f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe	88
PID 1520 wrote to memory of 2508	1520	f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe	88
PID 3456 wrote to memory of 756	3456	Unicorn-64284.exe	90
PID 3456 wrote to memory of 756	3456	Unicorn-64284.exe	90
PID 3456 wrote to memory of 756	3456	Unicorn-64284.exe	90
PID 436 wrote to memory of 2196	436	Unicorn-9572.exe	91
PID 436 wrote to memory of 2196	436	Unicorn-9572.exe	91
PID 436 wrote to memory of 2196	436	Unicorn-9572.exe	91
PID 2508 wrote to memory of 3172	2508	Unicorn-49188.exe	92
PID 2508 wrote to memory of 3172	2508	Unicorn-49188.exe	92
PID 2508 wrote to memory of 3172	2508	Unicorn-49188.exe	92
PID 1520 wrote to memory of 2420	1520	f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe	93
PID 1520 wrote to memory of 2420	1520	f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe	93
PID 1520 wrote to memory of 2420	1520	f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe	93
PID 756 wrote to memory of 1304	756	Unicorn-30481.exe	96
PID 756 wrote to memory of 1304	756	Unicorn-30481.exe	96
PID 756 wrote to memory of 1304	756	Unicorn-30481.exe	96
PID 3456 wrote to memory of 532	3456	Unicorn-64284.exe	97
PID 3456 wrote to memory of 532	3456	Unicorn-64284.exe	97
PID 3456 wrote to memory of 532	3456	Unicorn-64284.exe	97
PID 2196 wrote to memory of 3476	2196	Unicorn-51648.exe	98
PID 2196 wrote to memory of 3476	2196	Unicorn-51648.exe	98
PID 2196 wrote to memory of 3476	2196	Unicorn-51648.exe	98
PID 2420 wrote to memory of 3152	2420	Unicorn-62451.exe	99
PID 2420 wrote to memory of 3152	2420	Unicorn-62451.exe	99
PID 2420 wrote to memory of 3152	2420	Unicorn-62451.exe	99
PID 1520 wrote to memory of 1944	1520	f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe	102
PID 1520 wrote to memory of 1944	1520	f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe	102
PID 1520 wrote to memory of 1944	1520	f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe	102
PID 2508 wrote to memory of 2496	2508	Unicorn-49188.exe	100
PID 2508 wrote to memory of 2496	2508	Unicorn-49188.exe	100
PID 2508 wrote to memory of 2496	2508	Unicorn-49188.exe	100
PID 436 wrote to memory of 4980	436	Unicorn-9572.exe	101
PID 436 wrote to memory of 4980	436	Unicorn-9572.exe	101
PID 436 wrote to memory of 4980	436	Unicorn-9572.exe	101
PID 3172 wrote to memory of 860	3172	Unicorn-60413.exe	103
PID 3172 wrote to memory of 860	3172	Unicorn-60413.exe	103
PID 3172 wrote to memory of 860	3172	Unicorn-60413.exe	103
PID 1304 wrote to memory of 1428	1304	Unicorn-58441.exe	104
PID 1304 wrote to memory of 1428	1304	Unicorn-58441.exe	104
PID 1304 wrote to memory of 1428	1304	Unicorn-58441.exe	104
PID 756 wrote to memory of 2780	756	Unicorn-30481.exe	105
PID 756 wrote to memory of 2780	756	Unicorn-30481.exe	105
PID 756 wrote to memory of 2780	756	Unicorn-30481.exe	105
PID 532 wrote to memory of 2788	532	Unicorn-50828.exe	106
PID 532 wrote to memory of 2788	532	Unicorn-50828.exe	106
PID 532 wrote to memory of 2788	532	Unicorn-50828.exe	106
PID 3456 wrote to memory of 1068	3456	Unicorn-64284.exe	107
PID 3456 wrote to memory of 1068	3456	Unicorn-64284.exe	107
PID 3456 wrote to memory of 1068	3456	Unicorn-64284.exe	107
PID 2496 wrote to memory of 3272	2496	Unicorn-1819.exe	108
PID 2496 wrote to memory of 3272	2496	Unicorn-1819.exe	108
PID 2496 wrote to memory of 3272	2496	Unicorn-1819.exe	108
PID 2508 wrote to memory of 3588	2508	Unicorn-49188.exe	109
PID 2508 wrote to memory of 3588	2508	Unicorn-49188.exe	109
PID 2508 wrote to memory of 3588	2508	Unicorn-49188.exe	109
PID 3476 wrote to memory of 556	3476	Unicorn-33937.exe	110

C:\Users\Admin\AppData\Local\Temp\f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe
"C:\Users\Admin\AppData\Local\Temp\f918e2aef8d0f0c9ac55bb689510939bf65e309ba6961a0c375a570ab7cb79f7.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64284.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58441.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52017.exe
        9⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        10⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        11⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        11⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        11⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        10⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        10⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        9⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        9⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        9⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23599.exe
        8⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        9⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        10⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36939.exe
        10⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
        10⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46488.exe
        9⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        9⤵
        
        PID:16584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25794.exe
        9⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62851.exe
        8⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        8⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        8⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        9⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35845.exe
        10⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        10⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        9⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
        9⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33502.exe
        8⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30396.exe
        8⤵
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53039.exe
        8⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34980.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
        8⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        8⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        8⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        7⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3607.exe
        7⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30066.exe
        7⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55400.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        7⤵
        Executes dropped EXE
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        8⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
        10⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
        10⤵
        
        PID:17496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        9⤵
        
        PID:18376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60747.exe
        8⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
        9⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
        9⤵
        
        PID:17544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        8⤵
        
        PID:12960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        8⤵
        
        PID:17020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        8⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16199.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37897.exe
        8⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        9⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        9⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        9⤵
        
        PID:18348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
        8⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46591.exe
        8⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60251.exe
        7⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
        7⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23198.exe
        6⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
        8⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        9⤵
        
        PID:11436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exe
        9⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        8⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36368.exe
        8⤵
        
        PID:17652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        8⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        8⤵
        
        PID:16400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16400 -s 76
        9⤵
        Program crash
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        8⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        7⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        7⤵
        
        PID:16544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25211.exe
        7⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        6⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44345.exe
        8⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        8⤵
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36955.exe
        8⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        7⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        7⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
        6⤵
        
        PID:12636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24731.exe
        6⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44928.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        9⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10411.exe
        10⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50796.exe
        10⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        9⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        9⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61207.exe
        9⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
        8⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        8⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
        8⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20217.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14412.exe
        9⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        9⤵
        
        PID:17276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe
        9⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        8⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1075.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        8⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
        8⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exe
        7⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46402.exe
        7⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        6⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36641.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
        8⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16769.exe
        9⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        9⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        9⤵
        
        PID:16968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        9⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        8⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        8⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
        8⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-875.exe
        7⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
        7⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        7⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        7⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        7⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61700.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
        6⤵
        
        PID:12772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37082.exe
        6⤵
        
        PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37423.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        6⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24005.exe
        7⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        9⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        9⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44547.exe
        9⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25299.exe
        8⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        8⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8419.exe
        8⤵
        
        PID:16632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44072.exe
        7⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2854.exe
        7⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        7⤵
        
        PID:16696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
        7⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        6⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
        7⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10531.exe
        7⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9227.exe
        6⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        6⤵
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        5⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2034.exe
        7⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
        7⤵
        
        PID:16792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
        7⤵
        
        PID:18388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33502.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18143.exe
        6⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7922.exe
        6⤵
        
        PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
        5⤵
        
        PID:5896
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 632
        6⤵
        Program crash
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35347.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        6⤵
        
        PID:14732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        6⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50745.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40086.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47527.exe
        5⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65112.exe
        5⤵
        
        PID:7636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50828.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31737.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
        7⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        9⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64765.exe
        10⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        10⤵
        
        PID:17248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
        10⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46052.exe
        9⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22207.exe
        9⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        8⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3726.exe
        8⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
        8⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        8⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39383.exe
        8⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18890.exe
        8⤵
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36628.exe
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20142.exe
        7⤵
        
        PID:15088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
        6⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40267.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        8⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54220.exe
        8⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        8⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
        7⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
        7⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        7⤵
        
        PID:8776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        7⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        7⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59732.exe
        7⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3607.exe
        6⤵
        
        PID:15056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        6⤵
        
        PID:18400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
        6⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        8⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        8⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        8⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41547.exe
        7⤵
        
        PID:17228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        6⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46841.exe
        7⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        7⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
        7⤵
        
        PID:17640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        6⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27158.exe
        6⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25595.exe
        6⤵
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe
        5⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8143.exe
        7⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8611.exe
        7⤵
        
        PID:16872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55511.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exe
        6⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32676.exe
        5⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        6⤵
        
        PID:11688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        6⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5182.exe
        6⤵
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32230.exe
        5⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35611.exe
        6⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46049.exe
        5⤵
        
        PID:17292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4410.exe
        5⤵
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58471.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16885.exe
        6⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24005.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
        8⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
        9⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        9⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        9⤵
        
        PID:18420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47256.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        8⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
        8⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58083.exe
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42099.exe
        7⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54729.exe
        8⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe
        8⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        7⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
        7⤵
        
        PID:16736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55528.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37200.exe
        7⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        6⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33583.exe
        5⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26154.exe
        7⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
        7⤵
        
        PID:17628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21295.exe
        6⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
        7⤵
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
        6⤵
        
        PID:12800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54184.exe
        6⤵
        
        PID:17300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exe
        6⤵
        
        PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55009.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        6⤵
        
        PID:13556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exe
        6⤵
        
        PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18414.exe
        5⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        5⤵
        
        PID:8584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
        5⤵
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
        6⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        7⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
        7⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exe
        6⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45144.exe
        6⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33495.exe
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exe
        6⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
        6⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        5⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49915.exe
        5⤵
        
        PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
      4⤵
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
        5⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
        6⤵
        
        PID:12868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        6⤵
        
        PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        5⤵
        
        PID:15364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27895.exe
      4⤵
      PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17166.exe
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        5⤵
        
        PID:13448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25410.exe
        5⤵
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-280.exe
      4⤵
      PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28201.exe
        5⤵
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
        5⤵
        
        PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
      4⤵
      PID:12736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42804.exe
      4⤵
      PID:18300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51648.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33937.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45141.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        8⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1724.exe
        9⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49611.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41531.exe
        8⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        8⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        8⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        8⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11159.exe
        8⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
        7⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        7⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20558.exe
        7⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11996.exe
        7⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31303.exe
        7⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        7⤵
        
        PID:17196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30760.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
        6⤵
        
        PID:8984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
        6⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        7⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41545.exe
        8⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
        9⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61828.exe
        9⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        9⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        8⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45368.exe
        8⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        7⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        7⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        6⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        7⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        7⤵
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15298.exe
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        6⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41547.exe
        6⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53273.exe
        6⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42787.exe
        7⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
        7⤵
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25299.exe
        6⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
        6⤵
        
        PID:16812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        6⤵
        
        PID:17664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55007.exe
        5⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47189.exe
        6⤵
        
        PID:14312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        5⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        5⤵
        
        PID:16564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65115.exe
        5⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9815.exe
        5⤵
        
        PID:11592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4855.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
        6⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11472.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61781.exe
        8⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18563.exe
        7⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
        7⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
        7⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63532.exe
        6⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7300 -s 716
        7⤵
        Program crash
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        6⤵
        
        PID:16664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        6⤵
        
        PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51804.exe
        5⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        6⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31045.exe
        7⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        7⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        6⤵
        
        PID:13984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58083.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27054.exe
        5⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62129.exe
        6⤵
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9455.exe
        6⤵
        
        PID:12060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9412.exe
        5⤵
        
        PID:15232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10408.exe
        5⤵
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21125.exe
        7⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
        7⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
        6⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        6⤵
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49915.exe
        6⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43303.exe
        5⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exe
        6⤵
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        6⤵
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23610.exe
        6⤵
        
        PID:18364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe
        5⤵
        
        PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
        6⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
        6⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
        5⤵
        
        PID:14856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54047.exe
      4⤵
      PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe
        5⤵
        
        PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
        5⤵
        
        PID:14804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        5⤵
        
        PID:8688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
      4⤵
      PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47829.exe
      4⤵
      PID:15640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50922.exe
      4⤵
      PID:16424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15554.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11264.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        6⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25217.exe
        8⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        8⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41039.exe
        8⤵
        
        PID:17488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
        7⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64101.exe
        8⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63484.exe
        8⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
        7⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
        7⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36863.exe
        6⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57483.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-707.exe
        6⤵
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        6⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55696.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        6⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43873.exe
        7⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14475.exe
        7⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        6⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14802.exe
        5⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        5⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
        5⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57884.exe
        5⤵
        
        PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32047.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
        5⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        7⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
        7⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41531.exe
        6⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        6⤵
        
        PID:14564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
        6⤵
        
        PID:18284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        6⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43447.exe
        6⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        5⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12062.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
        5⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49441.exe
        6⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        6⤵
        
        PID:14808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36368.exe
        5⤵
        
        PID:18248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3179.exe
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
        5⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
        5⤵
        
        PID:17700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe
      4⤵
      PID:11764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44551.exe
      4⤵
      PID:16464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50102.exe
      4⤵
      PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        5⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5888.exe
        6⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
        7⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42367.exe
        7⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        7⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35475.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        6⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28288.exe
        6⤵
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10722.exe
        6⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        5⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35839.exe
        6⤵
        
        PID:17220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        5⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58083.exe
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
      4⤵
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15556.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
        6⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27058.exe
        6⤵
        
        PID:16792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
        5⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
        5⤵
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11999.exe
        5⤵
        
        PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11730.exe
      4⤵
      PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52876.exe
        5⤵
        
        PID:12408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        5⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
        5⤵
        
        PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
      4⤵
      PID:11272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
      4⤵
      PID:16736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42661.exe
      4⤵
      PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
      4⤵
      PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11472.exe
        5⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        6⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11126.exe
        6⤵
        
        PID:16468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        6⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        5⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        5⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
      4⤵
      PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
      4⤵
      PID:10596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
      4⤵
      PID:16524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-707.exe
      4⤵
      PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
    3⤵
    PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
      4⤵
      PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        5⤵
        
        PID:11448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-795.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25786.exe
      4⤵
      PID:15620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60581.exe
    3⤵
    PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53333.exe
      4⤵
      PID:10844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
      4⤵
      PID:16252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63240.exe
      4⤵
      PID:8760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41274.exe
    3⤵
    PID:11876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
    3⤵
    PID:15524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51727.exe
    3⤵
    PID:16716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
    3⤵
    PID:2832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58737.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        9⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
        9⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        9⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41531.exe
        8⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        8⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25164.exe
        8⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53333.exe
        8⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        8⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3706.exe
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39035.exe
        7⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27220.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21511.exe
        7⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40703.exe
        6⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39869.exe
        7⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        8⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        8⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34899.exe
        7⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
        7⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
        7⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20578.exe
        7⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49355.exe
        7⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
        6⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50152.exe
        7⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        7⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
        6⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49159.exe
        6⤵
        
        PID:16644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57518.exe
        6⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13739.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20217.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6332.exe
        8⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38179.exe
        8⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        8⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46488.exe
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        7⤵
        
        PID:16680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
        7⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        6⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
        6⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
        6⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49587.exe
        5⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14544.exe
        6⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14412.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exe
        7⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        6⤵
        
        PID:16628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12006.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        5⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36961.exe
        6⤵
        
        PID:16512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58795.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29449.exe
        5⤵
        
        PID:16412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-740.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2816.exe
        6⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        8⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        8⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        8⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        7⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58083.exe
        7⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9050.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
        6⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
        6⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6332.exe
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30203.exe
        6⤵
        
        PID:14848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        5⤵
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        5⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
        5⤵
        
        PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4751.exe
      4⤵
      PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2816.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40453.exe
        7⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
        7⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36783.exe
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
        6⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-158.exe
        6⤵
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36911.exe
        6⤵
        
        PID:11704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44072.exe
        5⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18793.exe
        6⤵
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10199.exe
        6⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2854.exe
        5⤵
        
        PID:11544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        5⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        5⤵
        
        PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27134.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60984.exe
        5⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57483.exe
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43515.exe
      4⤵
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
        5⤵
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exe
        5⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        5⤵
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55213.exe
      4⤵
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16103.exe
      4⤵
      PID:8752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1819.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12608.exe
        6⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53553.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52453.exe
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        9⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe
        9⤵
        
        PID:17184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47256.exe
        8⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        8⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe
        8⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        8⤵
        
        PID:15864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
        7⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33495.exe
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
        7⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47256.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        7⤵
        
        PID:18328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55835.exe
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        6⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
        6⤵
        
        PID:588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34891.exe
        5⤵
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40267.exe
        6⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        7⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        7⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
        7⤵
        
        PID:17692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exe
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-714.exe
        6⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46184.exe
        6⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33629.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
        7⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        6⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65483.exe
        6⤵
        
        PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20667.exe
        5⤵
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33574.exe
        5⤵
        
        PID:17520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40791.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        5⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57829.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        7⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55319.exe
        7⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22279.exe
        7⤵
        
        PID:16568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        6⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe
        7⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        7⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        6⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        5⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18338.exe
        6⤵
        
        PID:11344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20142.exe
        5⤵
        
        PID:15076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11870.exe
      4⤵
      PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
        6⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-380.exe
        7⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        7⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1563.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        6⤵
        
        PID:16688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
        6⤵
        
        PID:10976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        5⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42107.exe
        5⤵
        
        PID:12388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        5⤵
        
        PID:16820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
      4⤵
      PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6332.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        5⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31334.exe
        5⤵
        
        PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
      4⤵
      PID:9560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
      4⤵
      PID:15028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9262.exe
      4⤵
      PID:8452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23709.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        5⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        6⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        7⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26872.exe
        6⤵
        
        PID:10720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36862.exe
        6⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        6⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33495.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40009.exe
        6⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1071.exe
        7⤵
        
        PID:16016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2034.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exe
        6⤵
        
        PID:17344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        5⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        5⤵
        
        PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53553.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        6⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        7⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        7⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13431.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        6⤵
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54352.exe
        5⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11864.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63888.exe
        5⤵
        
        PID:18412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        5⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52876.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49644.exe
        6⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        5⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20667.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
      4⤵
      PID:12656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-476.exe
      4⤵
      PID:1272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35504.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50925.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49611.exe
        5⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43204.exe
        5⤵
        
        PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
      4⤵
      PID:9012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
      4⤵
      PID:13592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36702.exe
      4⤵
      PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25598.exe
    3⤵
    PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64409.exe
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6711.exe
        5⤵
        
        PID:12652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        5⤵
        
        PID:17200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34707.exe
      4⤵
      PID:10196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
      4⤵
      PID:14616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
      4⤵
      PID:18268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
    3⤵
    PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23593.exe
      4⤵
      PID:9828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34863.exe
      4⤵
      PID:16172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41039.exe
      4⤵
      PID:3300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6100.exe
    3⤵
    PID:10712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15862.exe
    3⤵
    PID:15400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28931.exe
    3⤵
    PID:7940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62451.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62451.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21685.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        6⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        8⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        8⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        7⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30760.exe
        7⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        7⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        6⤵
        
        PID:16068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3304.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49441.exe
        7⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        7⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        6⤵
        
        PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65015.exe
        5⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
        6⤵
        
        PID:13392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
        6⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
        5⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
        5⤵
        
        PID:16552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49159.exe
        5⤵
        
        PID:16016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
        5⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        7⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55859.exe
        7⤵
        
        PID:17008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        6⤵
        
        PID:14596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43303.exe
        5⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        6⤵
        
        PID:14752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30782.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        5⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        5⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        5⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        5⤵
        
        PID:820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
      4⤵
      PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        5⤵
        
        PID:12284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        5⤵
        
        PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
      4⤵
      PID:9648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
      4⤵
      PID:14704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
      4⤵
      PID:17556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
        5⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3304.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        7⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22249.exe
        8⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
        7⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12368.exe
        7⤵
        
        PID:17712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        6⤵
        
        PID:15104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38544.exe
        6⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe
        5⤵
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59264.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
        5⤵
        
        PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
      4⤵
      PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        5⤵
        
        PID:9836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        5⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
      4⤵
      PID:10308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
      4⤵
      PID:11428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-326.exe
      4⤵
      PID:5672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
      4⤵
      PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54513.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        6⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39051.exe
        7⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44547.exe
        7⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        6⤵
        
        PID:14032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        6⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39035.exe
        5⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        5⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62544.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35991.exe
      4⤵
      PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7095.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
        5⤵
        
        PID:940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48443.exe
      4⤵
      PID:10188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
      4⤵
      PID:14524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
      4⤵
      PID:7456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
    3⤵
    PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
      4⤵
      PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55009.exe
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41531.exe
      4⤵
      PID:10060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
      4⤵
      PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
      4⤵
      PID:8616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39875.exe
    3⤵
    PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
      4⤵
      PID:10640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1423.exe
      4⤵
      PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
      4⤵
      PID:7736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exe
    3⤵
    PID:10440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45753.exe
    3⤵
    PID:15576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41067.exe
    3⤵
    PID:7468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62068.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62068.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64165.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14300.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        7⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        7⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
        7⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30475.exe
        5⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28284.exe
        6⤵
        
        PID:12604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57375.exe
        6⤵
        
        PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15298.exe
        5⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        5⤵
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28527.exe
        5⤵
        
        PID:1408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
      4⤵
      PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
      4⤵
      PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-896.exe
        5⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22773.exe
        6⤵
        
        PID:11788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58964.exe
        6⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        5⤵
        
        PID:12396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        5⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
      4⤵
      PID:8972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
      4⤵
      PID:10880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57884.exe
      4⤵
      PID:14512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3459.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42889.exe
      4⤵
      PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        5⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26450.exe
        6⤵
        
        PID:14400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        6⤵
        
        PID:18356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        5⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        5⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        5⤵
        
        PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33407.exe
      4⤵
      PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
      4⤵
      PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
      4⤵
      PID:15896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
      4⤵
      PID:7260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3894.exe
    3⤵
    PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30780.exe
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
        5⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        5⤵
        
        PID:17024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
      4⤵
      PID:10232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
      4⤵
      PID:14720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
    3⤵
    PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
      4⤵
      PID:10708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50152.exe
      4⤵
      PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23378.exe
      4⤵
      PID:16920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
    3⤵
    PID:11036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-867.exe
    3⤵
    PID:16004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe
    3⤵
    PID:16920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
      4⤵
      PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exe
        5⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17187.exe
        6⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
        5⤵
        
        PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        5⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62112.exe
        5⤵
        
        PID:11980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
      4⤵
      PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
      4⤵
      PID:11176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
      4⤵
      PID:16060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37086.exe
      4⤵
      PID:4024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
    3⤵
    PID:5284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30780.exe
      4⤵
      PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30447.exe
      4⤵
      PID:13644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe
    3⤵
    PID:9680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
    3⤵
    PID:14828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
    3⤵
    PID:18084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1943.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1943.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
    3⤵
    PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
      4⤵
      PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18371.exe
        5⤵
        
        PID:9108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        5⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        5⤵
        
        PID:8604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe
      4⤵
      PID:10132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
      4⤵
      PID:14580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
      4⤵
      PID:18276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33407.exe
    3⤵
    PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29021.exe
      4⤵
      PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
      4⤵
      PID:12468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
    3⤵
    PID:10684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56540.exe
    3⤵
    PID:15932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41747.exe
    3⤵
    PID:7696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
  2⤵
  PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61633.exe
    3⤵
    PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
      4⤵
      PID:10652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1423.exe
      4⤵
      PID:15440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27058.exe
      4⤵
      PID:16444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32699.exe
    3⤵
    PID:10956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
    3⤵
    PID:15876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12503.exe
    3⤵
    PID:4324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
  2⤵
  PID:7884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
    3⤵
    PID:10012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
    3⤵
    PID:16352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
  2⤵
  PID:11480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38951.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38951.exe
  2⤵
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15091.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15091.exe
  2⤵
  PID:6280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5896 -ip 5896
1⤵
PID:7732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 7300 -ip 7300
1⤵
PID:14476

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-15554.exe

Filesize
468KB

MD5
07fa073be19de091e0b0f2ad1a29e2df

SHA1
1dcae1a87a4824b76625ed3e473f1344e002e47a

SHA256
b745f60c4fa995291e80748102a7cf3f0c9d465f6558184beeb11194a776630d

SHA512
f23177eb811ffd50bdd4040ec5e6317b7596947a207559ac7a3b305caa06daae00eb56158f873c6a216688fdd443480bef9e02fbe54cb5351c78d6cb3485023f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe

Filesize
468KB

MD5
182f1f829bc8ede5800674a26a14a857

SHA1
6af1a132e9e8e664ff6e9789d219222e9a7bbbf6

SHA256
6b9ba2e97892ce0c10718e9a849561c0a26d2cb41a7c1af992424a3c84cc86e4

SHA512
01ffa585cdc8c876f434d4ee4f6c630d0e140dddbb9ca9ece792ea22b9ad7ba9623478e1a592e9f0a65f02a6f1fc8d26f368e69166fa371bfcb21f41056c92e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1819.exe

Filesize
468KB

MD5
089fa57521eff65dc806e9f0c9afa8d5

SHA1
12f5e9539c15dffdb204f75639d4e30d101d4eaa

SHA256
4be4b8b036d6af09a8c7ddee056170dcd608561669af4caa8fa6b2309d44fbd3

SHA512
f83f9ec83f91eb5028080e8539b736373776b25ff23132e39b79af971e6a69dc5dfa9be13cd323d74d40e39068e12e827b53c98f9844638478f12eea11e5dd1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe

Filesize
468KB

MD5
d39e2486581f80e599a18d9befb78f24

SHA1
8290b1e8aa8392d94758b52cc90a4610599d1100

SHA256
983669d1f72319b6993f1a7972bb2a45a05856bc55164cd6359af6b5f3446aa1

SHA512
f5b287d670db04b4c830845c5d9cbc6b945bb4c40bda6ecb7f2a971d393c00035c0f31b80a59e59a2f1669538c968e2d7684259b11c26da5480a0cad732fdbb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21685.exe

Filesize
468KB

MD5
65ccc16ef1e42997a25a88c49340a96f

SHA1
29e51ba2b1348d88cc19c9978a5c510d4f6c73e3

SHA256
9b6d73620cc9453850aa0e9cb4483975639c07d8621f3bd8ba139b3b08c2f4c6

SHA512
5f4ffc3c454063ec6d3516ac02b6f6e6a64d8659ffd3d9de72506b4289e0989c3e2e141022059a5f25395b458591afa8d336f6443b18fcf07302e243e72baf94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe

Filesize
468KB

MD5
5468d071658e13a4bb7b739ec536ead4

SHA1
9433842346b9adfa40b006a59a438d0f26271c34

SHA256
9ec0147f88c78e645323386b490ff1436d0fd6e079d0f35a42d4eb323bde4bf1

SHA512
8c209f92f2d36fb85fa4af923ac6936771fc024ffa4777faca9a40c94dee3f4eacd5040618119c616705a6feafddcee7874373f180e5bf5e42beb9ee30d5ce2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe

Filesize
468KB

MD5
3c21ac0aecbba3883e20538e353df0c8

SHA1
2961042e971546c7f71a04f3fdb1884de5a80bfb

SHA256
87e68e88b151f6b70c3f617b5923b65d391dcd91ec682b8a45d86fe2a0d46a50

SHA512
631ba55d299b9cc9240bb075c43102653479b6471f9d7e6dcdb9c1dc240070c871dff5687299a0478b9c2233a2e2f5e9dd472bf5e61529da2aed50146f467193

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31737.exe

Filesize
468KB

MD5
18b639c67a1986a1d904be37a154f95d

SHA1
65a8da6214f1a195b742508dae6a97f3f2c864df

SHA256
59eb3c90521d615cace0cc3c317e44ba7486ca596a6f0ec4f69b3996ef3c0498

SHA512
b5603b036e4747bc5ec8173a9f8f4c1aed4bad0f019d00d2c5e209bc5d1ce96a77b2033489a5ccd7f7d78e78bcf64b4d59f0f249f2f31f55382e50934961be77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe

Filesize
468KB

MD5
ddf113f83229e71e72c2b611914e9fd9

SHA1
2bc3f9d76e1121804c4b0a18db55808120eb1ba8

SHA256
689a12a2528d9d1c7d6df76fffa4d836b27d7d992b9c47fc86013ef0ec939d1e

SHA512
cba189f1d14c72c433bca28f5c40b57e1528c384ac53251604048ec0941ef1f82dc8263b78705b8c80dea8e0e4e2d7add99b7be37188be957a693a0a8847d73a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33937.exe

Filesize
468KB

MD5
411b0331731c4a29685611a065698124

SHA1
0d35cdfbdea33b62356957a57d17eb4ddb4d68ff

SHA256
971a8cbe8d3901f7a56a977c0f0dae23096e9d57026a9a63bbdbb1a1768ea720

SHA512
d8b31710f8f9748fb3a43d17e4b8739b3445b6ffdbf97863937ba37e0f0570fe7715eaf6ec36e63eb67d227869cf4a251c5ed35799b73fa0d0c54d0e2dc12c66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe

Filesize
468KB

MD5
1dc69da394d956b31de7b3265e68ca66

SHA1
560527e2ee59c33a10b2aa9041f76f776b67329d

SHA256
b598f2c080a690149217be272fee43a006b3fb931e24ce29f0bf9de1e635fced

SHA512
191cadc75512ba643b190843be1b74f5b731e64cc809a3f5a21f62ca8e2cd4760adfb5681acd404dfbf504af538660be9723659fd55e309bd4d960832393945e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe

Filesize
468KB

MD5
7548ad7413e7d1a39ce6968211b92e6f

SHA1
7f73bdb4854c1de8e19c23560a807d359819c08b

SHA256
92a7319c6d3567ae7f4f9c1fa957e44ef9337c7171ef7f049bdb47245ba0b055

SHA512
829531438ea4bd7ecff1fa39438c005579a4cc6816061d380ce5250e4c96acf234497a7fb93061fb68f09f990672119b96bcd42cf4830f6a88db4bd14ef55041

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe

Filesize
468KB

MD5
d1183be129a5380542c38dbf9d3f386f

SHA1
cd37281520efffd7d7f203172e1af6260cff0e59

SHA256
0b91e5d8ad730c054ba4ffd0c96f3ebd0af7fe1c2398f2206aad1ff7e270ea84

SHA512
6b2fcfbaea9897da3f37edfb3a2b73d0e856efe781b5e0a7a41c956c377f2e0a0e6153658a477a0f8ed8ba8c16079c79b8a9303a16784efa0e1348541aeae962

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe

Filesize
468KB

MD5
d9258faeaa9a155132d8d2e3b5263d52

SHA1
f8d03b792b687c3d94f7e10093e4ad6cc2fb3725

SHA256
aca69c6dbcb874505b97e005cf6f6a9c59e6855ddad26f8035c59d56626bf1b4

SHA512
a2b300fafb5da60b52ce3d7e8298124d92c916a0d8e1b7a57b4a4877efab4306148dcdbd6bdafbfe8d5c5839ac8a28de4012768de723a77483f4b34eaba0d5e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44928.exe

Filesize
468KB

MD5
11f257ef5fc86c36db55b730ac36b41f

SHA1
f6d37261f88754d1316415223076d742fcbba4cf

SHA256
98c6559e12b86a1a403b20d1160707093c5fb91a87e9cf8134d552e2a079cd52

SHA512
bb292cfd8b060d6cb0bbfd0ab3d53879d0e9336d7aeef9ac3937efc48f4057a19e6976fbce3e0bf685b916a5a795c6651bc3a47b10b8f776ac589b20630b627b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45141.exe

Filesize
468KB

MD5
7829a15ab4b0829b1c5c9d2432c06005

SHA1
1fee0d9eb1a1368d9988b2157c8bb7e4e8b2a0f6

SHA256
acc607bf570c65779805e2527a775a204a3343626eeed6692616085c8d5b902b

SHA512
3e5f41aa50e1083f7c17a7572c93d614b7092c1dd06ba5e0535cdefaccdcdaf78a91fdd93e9c34846c42a5bddb79e4ff054ea271b1f56c72a5077676636207b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe

Filesize
468KB

MD5
fed6422cde584337d584dac9bee62c39

SHA1
c621f1e78e2fd244c2bc8ffe9588d80d5bc64b65

SHA256
37e92c6e8b52e2e0a8735ee43d138672431db34c03955f527ee716c41140f036

SHA512
9bfee35fd594bfee3ea201fd344f94be9ceceee8dcbaa51c5e07f0550163ff980c34a2f351cb5fd76b5a42cae1b12796bb967dca6e1f1343d1061e4b82de83b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4855.exe

Filesize
468KB

MD5
5e08f09ffc81e84984c364bcb85f06e9

SHA1
027ae8765d6f2f010ce450ff6bc791cfcac31f7e

SHA256
14bae6b52eab3d88173d94da188aa231ba897797b85b83fba0425914b5503fab

SHA512
a41166b9950816984eee41c2f24f37d8d3577b33304f0ad259db8ac43e8f98bea37cbbca6968e388a214ae338e5b26e369e608c6c96c8902c63fed249209948e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe

Filesize
468KB

MD5
63fa10cec3a4ad8f9ded547de2998b84

SHA1
0bdcfa2c4eda37a900b00fc11f52a38b7ca6d70a

SHA256
43ca72b2fc50bcc31c1a4db62ffce540cbac26e964e5720770848da0a7adf3cb

SHA512
e3e68362681cc85933dbf3b2a655d640d367a036d46db2645b47bec1dbca764cc91ef9b1ebf7d267b00a0c85dda40cd3758ccb96adcb84d380dc0e62f3b2fef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50828.exe

Filesize
468KB

MD5
475a7283906a3de875b11c2e9982e9cc

SHA1
d630be3a7dc4edbabedcc20f880a3e477d5ad897

SHA256
64341fe87312e08f64a2431cc25bf33d268264351936f117f3151d936c2d07ac

SHA512
f19997c0abecd0b1ca6a189458a26e6a57c122bc2a43c562c259157f6e07d3e010fbf0bc876f4b06c7051defaede0522a3412dfb530d418146a353550ff23d6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51648.exe

Filesize
468KB

MD5
a70ce2143873e81ed63188488c07286b

SHA1
5166974a8b9e519f9206a01678e5c0d4d6e1a68d

SHA256
f4bc3cc030d6d6d4dfd0a3e545d7132112fbfe805c2904c355dca3dd2d793692

SHA512
0a03b93f2ef7c4f04f795b96ad77d088ce4893c34ff40b77fa72ad5dc3583081032ffc0cc28033232925ac979fa062a8ad2cd4925160cf8404d88ad049d406d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe

Filesize
468KB

MD5
d00cb592b472dde3b988b458bbd34d49

SHA1
e6d65efec165bcf2b36ee114117d4a806c909350

SHA256
347c9c15560fbd5d33ae6c37b9c4b69b24a974e65d411e5300521e7ccbef453b

SHA512
73fad6698c5f9f0ababc46c4708e0a56d4d5a7b2fa0982b8c4c9c1b6a5bc672da0f27371e4470dad466f5de9cd0dfb2427be87d6f0947a7299d747799e93fe40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58441.exe

Filesize
468KB

MD5
276f02a15289a768fc00ce48c51b7b1e

SHA1
2df632637c5da4a177763806d62a39e375d2af6f

SHA256
0fd706e4e9873b0c9a22dace50f4e1081861e5e1743579d5fc44162e8b22dae5

SHA512
c4098dc32eb34a150a5f7aea4b6e7d36a050c5e81cb07c1887a7f270a99669d5fe15a797b5f22be4f696f615ed36995a74b5876623763054048fc6483c5e605b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58471.exe

Filesize
468KB

MD5
edb1df2598a6ddda0d8e2cb0164ca0e5

SHA1
68d84ff709abe12d309c9e9d0163f3ba67942236

SHA256
8cfd09e7e39b5cbf663a594920e1f7c2dee147cf1e215e88ba412b806debde4e

SHA512
df601c76ddf77b617a3db1a5a0ed121a4ddf34cab119a1076a657b0cbf99636baefe4822d0df0ab5e138193223948e7e38f095deb815c9db5e6a1d013cb7d58d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58737.exe

Filesize
468KB

MD5
3da5e1315920ff4026edc1c43c33c656

SHA1
50bcb169c1960eaeb7d135dfeb265d39d4d95c12

SHA256
fbf40d45d6a30c98675f99c115489e8042c01a8525fee82e34555ce85b5ad149

SHA512
7a5c96e72d3760edb74dfc12fdb156d16de0c1719900824c65c09f935b1d2a365118affe331c397883cd574b74421a6a939728231da6b5ea8db685a50e74953b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe

Filesize
468KB

MD5
3fffcc43ae00874374232b34e58a877a

SHA1
686293e3449960d70b3737fd3a93ed4093aadcc7

SHA256
335b8f4c4c6fb1c454dc98accb6a4b9b635f90c6de3698fd787f3a9e90c5a646

SHA512
b549a59629f273c6f00041278b22ce5f984a53f5627c07dcc2bc4f1b9136e7ba8a86da78d312bf8c2b6d5cc147a43f926106addc5a9350e81f92248e472b57c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe

Filesize
468KB

MD5
89c9b621efa799417a6ce0a75be9484a

SHA1
a70e2138af2fb56da447f3167db72315d154a6d2

SHA256
e6522af5898dbbb8955c1b32d464415124829fbd0ce3dcecfa1aabf48740ad61

SHA512
1847c6d5e6c7cc64057c0fc9c35aaaa4f77c5e1d54d7842559e19e247fb2c7c07a9d821daf33ea5fa7099640eb7a43ff91a78d25feacf2af853045f28392ea2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62068.exe

Filesize
468KB

MD5
6e90bbf834a4ee45b41f5ad7e2615c98

SHA1
f7270230e7da1a1e406565d4363b8d0c1ffccd3b

SHA256
05bb3fdd34aad7d730b95fb4537f4a3aa07e428ded2245d0eed4a8c6d496d613

SHA512
123eb0d83044cef722ed9f7110274e22d93edc36b79ad2d08c75f96337ca83467f8a9eb8c538e39c17dd65961404024d6e0be7911eeec291cf97cd8355a9131a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62451.exe

Filesize
468KB

MD5
c4c3b28b2734d8419fde94a877a07af9

SHA1
62e239a9e05eea392a1b29c8ca75de55626f53e3

SHA256
bf4fbd93a9ecc9900d11b88baf9ed47bc1df2c8f0bc53f0d90b4350995560f55

SHA512
a29c6146b3b5b4f0726cb4a13f085411a9eeeb1fef22fc2f20ca950af6a9e5d5829c7f610e115401cb79a7fbb314bb32aaeb5e0d9f1f661b74731a0b4c409a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64284.exe

Filesize
468KB

MD5
296cfcbe4cb8d409b5edeeabf2321449

SHA1
c560391967e7bdf020107b15d6290fc1ee91c6a9

SHA256
5d492e08a5ddd3b9c9f8cfb185525415f71140373578e65d27d5cc6295240be9

SHA512
e6482f1c322ad6ad71fba75704ec5c160afeb4ad706cb73117348039e2232688c7dcd6042f0f2987728fe68f39d14e6034fb9a850f589dcbaa340993d305b9e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe

Filesize
468KB

MD5
8c707cb3c4ec3d137789c33e82e21731

SHA1
a11223d8d69ade500fe884d00de2f0cdc03163f6

SHA256
22d2d3293c2962faa13f9f4e1b29b11cd8ef885f82c1d1fae83cb96fc8f51dd2

SHA512
6f237bf413c326d604bb3e455f4c4a89648cee279ed555dd2c6534e6741eb27a197b4fd06614541ba2ee2608f66db91caa2cb798d96f94b6ba472312f0984f3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe

Filesize
468KB

MD5
40be764bf448936f0f93a19bdeaae3c3

SHA1
21017fd17847bb450ed2bc9c8c8c786794aa8c33

SHA256
45e205ac9c87ffc46c8f5af6629799b04fb37c641a30b24e9385ea3f6447cace

SHA512
b70d0691a57666a12ae990e8c409b3fc63b0f61dfa44057865d4eadf7af1a729a4ad7215c07ea2f53c65a6c90aca8a775f683656b680cfffd674b4ff714faade

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe

Filesize
468KB

MD5
d0168c420b1867ef7361cfcba443b493

SHA1
a4f71e9cdc6d578bcadbdb47864d50a2e37c16de

SHA256
b9eab7747149e592a97cf8c7c62ad66a9324b8f35e015a3aa6a995e40a3cb5fb

SHA512
74ba5f9568a2973682241517cb8b7e86146f8565fd13a52c20fdcaf478b4d642bb08fcb3e70f193b7de38199d723223ce15b9154460ca806b08f1d17e5cc54b3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads