1b19cff3e164ecf48cc5088c05745481ad5ca1334408a1e0d4cbadf34163b54c

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d212947f03298b7c0e693cef8799bdb0N.exe
Size

468KB
MD5

d212947f03298b7c0e693cef8799bdb0
SHA1

05164795c9e9852edf5b3fc37de606a6be8bbfa9
SHA256

1b19cff3e164ecf48cc5088c05745481ad5ca1334408a1e0d4cbadf34163b54c
SHA512

9c22ee7b375b8188ddc34b40648b73c0160ef80d9bb646c4197e792a425ffc405d72d849755cdab7ab766c6439f097d63d75edd01564739158be87ac75c800e3
SSDEEP

3072:KbY1ogInI05UtbYZPztucf1/ECMvPJpacmHeGV4Aw5D8Vmcuk+lV:Kbqo28Ut6PJucfi/Pow5wUcuk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4040	Unicorn-3498.exe
3564	Unicorn-22295.exe
3204	Unicorn-47546.exe
5052	Unicorn-21859.exe
1752	Unicorn-23896.exe
5012	Unicorn-9606.exe
3516	Unicorn-55278.exe
3360	Unicorn-44163.exe
2068	Unicorn-32465.exe
436	Unicorn-15574.exe
2416	Unicorn-15574.exe
2904	Unicorn-15309.exe
4896	Unicorn-36741.exe
3012	Unicorn-50477.exe
1540	Unicorn-43129.exe
4708	Unicorn-46275.exe
3432	Unicorn-59274.exe
904	Unicorn-39259.exe
2176	Unicorn-14754.exe
5100	Unicorn-57825.exe
3420	Unicorn-44090.exe
3892	Unicorn-63955.exe
3320	Unicorn-27369.exe
2280	Unicorn-38305.exe
548	Unicorn-46970.exe
2212	Unicorn-41105.exe
3600	Unicorn-7738.exe
3896	Unicorn-51961.exe
868	Unicorn-29503.exe
3436	Unicorn-37671.exe
3788	Unicorn-62922.exe
748	Unicorn-31540.exe
2272	Unicorn-50478.exe
3148	Unicorn-50478.exe
4844	Unicorn-50478.exe
2412	Unicorn-57707.exe
688	Unicorn-17421.exe
5104	Unicorn-46379.exe
4304	Unicorn-493.exe
3556	Unicorn-13706.exe
2288	Unicorn-13706.exe
3424	Unicorn-58823.exe
4636	Unicorn-58558.exe
3192	Unicorn-27804.exe
2940	Unicorn-1817.exe
4532	Unicorn-21683.exe
628	Unicorn-4584.exe
3084	Unicorn-25767.exe
4756	Unicorn-25767.exe
4116	Unicorn-54282.exe
456	Unicorn-25767.exe
1048	Unicorn-7384.exe
4960	Unicorn-59186.exe
4500	Unicorn-3182.exe
4464	Unicorn-28049.exe
3180	Unicorn-2798.exe
4608	Unicorn-2798.exe
3936	Unicorn-64251.exe
4268	Unicorn-35279.exe
2760	Unicorn-39363.exe
2520	Unicorn-43182.exe
3944	Unicorn-22762.exe
2244	Unicorn-60530.exe
228	Unicorn-31941.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
6972	5124	WerFault.exe	175
8976	4268	WerFault.exe	154
9016	868	WerFault.exe	123
12108	5676	WerFault.exe	217
11984	5252	WerFault.exe	210
16864	7952	WerFault.exe	329
17116	16020	WerFault.exe	777

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3820.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	19532	Process not Found
Token: SeChangeNotifyPrivilege	19532	Process not Found
Token: 33	19532	Process not Found
Token: SeIncBasePriorityPrivilege	19532	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1600	d212947f03298b7c0e693cef8799bdb0N.exe
4040	Unicorn-3498.exe
3204	Unicorn-47546.exe
3564	Unicorn-22295.exe
5052	Unicorn-21859.exe
1752	Unicorn-23896.exe
5012	Unicorn-9606.exe
3516	Unicorn-55278.exe
3360	Unicorn-44163.exe
2068	Unicorn-32465.exe
436	Unicorn-15574.exe
2904	Unicorn-15309.exe
2416	Unicorn-15574.exe
4896	Unicorn-36741.exe
3012	Unicorn-50477.exe
1540	Unicorn-43129.exe
4708	Unicorn-46275.exe
3432	Unicorn-59274.exe
904	Unicorn-39259.exe
3320	Unicorn-27369.exe
2280	Unicorn-38305.exe
2212	Unicorn-41105.exe
2176	Unicorn-14754.exe
5100	Unicorn-57825.exe
3420	Unicorn-44090.exe
3892	Unicorn-63955.exe
548	Unicorn-46970.exe
3600	Unicorn-7738.exe
3896	Unicorn-51961.exe
868	Unicorn-29503.exe
748	Unicorn-31540.exe
3436	Unicorn-37671.exe
3788	Unicorn-62922.exe
4844	Unicorn-50478.exe
3148	Unicorn-50478.exe
2272	Unicorn-50478.exe
2412	Unicorn-57707.exe
688	Unicorn-17421.exe
5104	Unicorn-46379.exe
4304	Unicorn-493.exe
3556	Unicorn-13706.exe
2288	Unicorn-13706.exe
3424	Unicorn-58823.exe
4636	Unicorn-58558.exe
3192	Unicorn-27804.exe
2940	Unicorn-1817.exe
628	Unicorn-4584.exe
3084	Unicorn-25767.exe
1048	Unicorn-7384.exe
456	Unicorn-25767.exe
4960	Unicorn-59186.exe
4532	Unicorn-21683.exe
4116	Unicorn-54282.exe
4756	Unicorn-25767.exe
4500	Unicorn-3182.exe
4464	Unicorn-28049.exe
4608	Unicorn-2798.exe
3180	Unicorn-2798.exe
3936	Unicorn-64251.exe
4268	Unicorn-35279.exe
2520	Unicorn-43182.exe
2760	Unicorn-39363.exe
3944	Unicorn-22762.exe
4216	Unicorn-36623.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 4040	1600	d212947f03298b7c0e693cef8799bdb0N.exe	90
PID 1600 wrote to memory of 4040	1600	d212947f03298b7c0e693cef8799bdb0N.exe	90
PID 1600 wrote to memory of 4040	1600	d212947f03298b7c0e693cef8799bdb0N.exe	90
PID 4040 wrote to memory of 3564	4040	Unicorn-3498.exe	93
PID 4040 wrote to memory of 3564	4040	Unicorn-3498.exe	93
PID 4040 wrote to memory of 3564	4040	Unicorn-3498.exe	93
PID 1600 wrote to memory of 3204	1600	d212947f03298b7c0e693cef8799bdb0N.exe	94
PID 1600 wrote to memory of 3204	1600	d212947f03298b7c0e693cef8799bdb0N.exe	94
PID 1600 wrote to memory of 3204	1600	d212947f03298b7c0e693cef8799bdb0N.exe	94
PID 3204 wrote to memory of 5052	3204	Unicorn-47546.exe	96
PID 3204 wrote to memory of 5052	3204	Unicorn-47546.exe	96
PID 3204 wrote to memory of 5052	3204	Unicorn-47546.exe	96
PID 1600 wrote to memory of 1752	1600	d212947f03298b7c0e693cef8799bdb0N.exe	97
PID 1600 wrote to memory of 1752	1600	d212947f03298b7c0e693cef8799bdb0N.exe	97
PID 1600 wrote to memory of 1752	1600	d212947f03298b7c0e693cef8799bdb0N.exe	97
PID 3564 wrote to memory of 5012	3564	Unicorn-22295.exe	98
PID 3564 wrote to memory of 5012	3564	Unicorn-22295.exe	98
PID 3564 wrote to memory of 5012	3564	Unicorn-22295.exe	98
PID 4040 wrote to memory of 3516	4040	Unicorn-3498.exe	99
PID 4040 wrote to memory of 3516	4040	Unicorn-3498.exe	99
PID 4040 wrote to memory of 3516	4040	Unicorn-3498.exe	99
PID 5052 wrote to memory of 3360	5052	Unicorn-21859.exe	102
PID 5052 wrote to memory of 3360	5052	Unicorn-21859.exe	102
PID 5052 wrote to memory of 3360	5052	Unicorn-21859.exe	102
PID 3204 wrote to memory of 2068	3204	Unicorn-47546.exe	103
PID 3204 wrote to memory of 2068	3204	Unicorn-47546.exe	103
PID 3204 wrote to memory of 2068	3204	Unicorn-47546.exe	103
PID 3516 wrote to memory of 436	3516	Unicorn-55278.exe	105
PID 3516 wrote to memory of 436	3516	Unicorn-55278.exe	105
PID 3516 wrote to memory of 436	3516	Unicorn-55278.exe	105
PID 1752 wrote to memory of 2416	1752	Unicorn-23896.exe	106
PID 1752 wrote to memory of 2416	1752	Unicorn-23896.exe	106
PID 1752 wrote to memory of 2416	1752	Unicorn-23896.exe	106
PID 1600 wrote to memory of 2904	1600	d212947f03298b7c0e693cef8799bdb0N.exe	104
PID 1600 wrote to memory of 2904	1600	d212947f03298b7c0e693cef8799bdb0N.exe	104
PID 1600 wrote to memory of 2904	1600	d212947f03298b7c0e693cef8799bdb0N.exe	104
PID 3564 wrote to memory of 4896	3564	Unicorn-22295.exe	107
PID 3564 wrote to memory of 4896	3564	Unicorn-22295.exe	107
PID 3564 wrote to memory of 4896	3564	Unicorn-22295.exe	107
PID 4040 wrote to memory of 3012	4040	Unicorn-3498.exe	108
PID 4040 wrote to memory of 3012	4040	Unicorn-3498.exe	108
PID 4040 wrote to memory of 3012	4040	Unicorn-3498.exe	108
PID 5012 wrote to memory of 1540	5012	Unicorn-9606.exe	109
PID 5012 wrote to memory of 1540	5012	Unicorn-9606.exe	109
PID 5012 wrote to memory of 1540	5012	Unicorn-9606.exe	109
PID 3360 wrote to memory of 4708	3360	Unicorn-44163.exe	110
PID 3360 wrote to memory of 4708	3360	Unicorn-44163.exe	110
PID 3360 wrote to memory of 4708	3360	Unicorn-44163.exe	110
PID 5052 wrote to memory of 3432	5052	Unicorn-21859.exe	111
PID 5052 wrote to memory of 3432	5052	Unicorn-21859.exe	111
PID 5052 wrote to memory of 3432	5052	Unicorn-21859.exe	111
PID 436 wrote to memory of 904	436	Unicorn-15574.exe	112
PID 436 wrote to memory of 904	436	Unicorn-15574.exe	112
PID 436 wrote to memory of 904	436	Unicorn-15574.exe	112
PID 2068 wrote to memory of 2176	2068	Unicorn-32465.exe	113
PID 2068 wrote to memory of 2176	2068	Unicorn-32465.exe	113
PID 2068 wrote to memory of 2176	2068	Unicorn-32465.exe	113
PID 3516 wrote to memory of 3420	3516	Unicorn-55278.exe	115
PID 3516 wrote to memory of 3420	3516	Unicorn-55278.exe	115
PID 3516 wrote to memory of 3420	3516	Unicorn-55278.exe	115
PID 3204 wrote to memory of 5100	3204	Unicorn-47546.exe	114
PID 3204 wrote to memory of 5100	3204	Unicorn-47546.exe	114
PID 3204 wrote to memory of 5100	3204	Unicorn-47546.exe	114
PID 2904 wrote to memory of 3892	2904	Unicorn-15309.exe	116

C:\Users\Admin\AppData\Local\Temp\d212947f03298b7c0e693cef8799bdb0N.exe
"C:\Users\Admin\AppData\Local\Temp\d212947f03298b7c0e693cef8799bdb0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3498.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3498.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3182.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37967.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        9⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        10⤵
        
        PID:13284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe
        10⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18265.exe
        9⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        9⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53776.exe
        9⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
        8⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
        9⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe
        8⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        8⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        9⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        9⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        9⤵
        
        PID:17060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49421.exe
        9⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28723.exe
        9⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44026.exe
        8⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
        7⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42761.exe
        7⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28049.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62663.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe
        9⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
        8⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        8⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49421.exe
        8⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11197.exe
        7⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63315.exe
        8⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
        7⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30032.exe
        7⤵
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43897.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2718.exe
        8⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        8⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        8⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        7⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2697.exe
        7⤵
        
        PID:17296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        6⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19299.exe
        7⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
        7⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56777.exe
        6⤵
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
        6⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52142.exe
        6⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51961.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exe
        8⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        9⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        9⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8964.exe
        9⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46941.exe
        8⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        8⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        7⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        8⤵
        
        PID:17908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17392.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
        7⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        7⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59710.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
        8⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-220.exe
        9⤵
        
        PID:17872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        8⤵
        
        PID:17956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe
        7⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        7⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
        7⤵
        
        PID:17932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43957.exe
        6⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53995.exe
        7⤵
        
        PID:17204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        7⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61846.exe
        6⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18744.exe
        6⤵
        
        PID:17316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34846.exe
        6⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43182.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
        8⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39168.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        7⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34696.exe
        7⤵
        
        PID:16956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        6⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20555.exe
        7⤵
        
        PID:16688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31063.exe
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34068.exe
        6⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60977.exe
        6⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24621.exe
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
        5⤵
        
        PID:11712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59865.exe
        5⤵
        
        PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3820.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        6⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe
        8⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        9⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        9⤵
        
        PID:16400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe
        9⤵
        
        PID:16556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        8⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        8⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44706.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47378.exe
        7⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        8⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        8⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36348.exe
        8⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        7⤵
        
        PID:17260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
        6⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
        7⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63154.exe
        7⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37823.exe
        7⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        6⤵
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        6⤵
        
        PID:13924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37240.exe
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51105.exe
        5⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        7⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        8⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7183.exe
        8⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        7⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        7⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48982.exe
        7⤵
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
        6⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
        7⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43553.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41392.exe
        7⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        6⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        6⤵
        
        PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        5⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        6⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62407.exe
        7⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3099.exe
        7⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58285.exe
        6⤵
        
        PID:13840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29330.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59953.exe
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26623.exe
        5⤵
        
        PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48299.exe
        6⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7393.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
        8⤵
        
        PID:17164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        8⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3988.exe
        7⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
        7⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2349.exe
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46330.exe
        7⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30148.exe
        7⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62753.exe
        6⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17955.exe
        7⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55038.exe
        7⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exe
        7⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13797.exe
        6⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        6⤵
        
        PID:16684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        7⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28723.exe
        8⤵
        
        PID:16536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44409.exe
        7⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        7⤵
        
        PID:16864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3604.exe
        6⤵
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
        6⤵
        
        PID:15320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42476.exe
        6⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        5⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3465.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25140.exe
        6⤵
        
        PID:15840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        5⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
        5⤵
        
        PID:14840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54440.exe
        5⤵
        
        PID:17596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58558.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12886.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
        6⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-916.exe
        7⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        7⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        6⤵
        
        PID:10616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        6⤵
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
        6⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        5⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54513.exe
        6⤵
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        5⤵
        
        PID:9452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
        5⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        5⤵
        
        PID:17604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
      4⤵
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
        5⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        6⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        6⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38457.exe
        6⤵
        
        PID:16672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10579.exe
        6⤵
        
        PID:8148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        5⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
      4⤵
      PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58285.exe
        5⤵
        
        PID:13848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
        5⤵
        
        PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32203.exe
        5⤵
        
        PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60483.exe
      4⤵
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10938.exe
        5⤵
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
        5⤵
        
        PID:17972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
      4⤵
      PID:13420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15574.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39259.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
        8⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21395.exe
        9⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47555.exe
        10⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        9⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
        9⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2941.exe
        9⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51654.exe
        8⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        9⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
        9⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
        8⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        8⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2697.exe
        8⤵
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        8⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23361.exe
        8⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        8⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
        7⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35035.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        8⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        9⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        9⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        9⤵
        
        PID:17744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        8⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        8⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        8⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63906.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45685.exe
        7⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        8⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        8⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        8⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18509.exe
        7⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51689.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4498.exe
        7⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        7⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe
        7⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
        7⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        6⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exe
        7⤵
        
        PID:16512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
        7⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        6⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21483.exe
        6⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17421.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        6⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37731.exe
        8⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        9⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        9⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        8⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        8⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exe
        8⤵
        
        PID:17888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10621.exe
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17955.exe
        8⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55038.exe
        8⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
        8⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        7⤵
        
        PID:17372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        7⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23575.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        7⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54513.exe
        7⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5192.exe
        6⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        7⤵
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5629.exe
        6⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1780.exe
        6⤵
        
        PID:12856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe
        6⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        7⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
        8⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16448.exe
        8⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21408.exe
        8⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42245.exe
        7⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        7⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56994.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17252.exe
        6⤵
        
        PID:13824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe
        6⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43025.exe
        5⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
        6⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        5⤵
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        5⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19316.exe
        5⤵
        
        PID:16448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        6⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        7⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        8⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24809.exe
        8⤵
        
        PID:16856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        8⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33973.exe
        7⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
        6⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        7⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48296.exe
        7⤵
        
        PID:17644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10094.exe
        6⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58047.exe
        6⤵
        
        PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-613.exe
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        7⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
        6⤵
        
        PID:16272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        6⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45825.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10030.exe
        6⤵
        
        PID:11516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17979.exe
        6⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        5⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exe
        5⤵
        
        PID:14688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48826.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7384.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        6⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36921.exe
        7⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
        7⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        6⤵
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        6⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
        5⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56757.exe
        6⤵
        
        PID:12224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50833.exe
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38930.exe
        5⤵
        
        PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
        5⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        6⤵
        
        PID:15980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3676.exe
        6⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        5⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
        5⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        5⤵
        
        PID:17380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2376.exe
      4⤵
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        5⤵
        
        PID:17768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
      4⤵
      PID:15312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        5⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20849.exe
        6⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38987.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        7⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        6⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53529.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        5⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57082.exe
        6⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26123.exe
        7⤵
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10881.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        7⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49822.exe
        5⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
        5⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13315.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59273.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        6⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35879.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        7⤵
        
        PID:17332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
        6⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        6⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49786.exe
        5⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        5⤵
        
        PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28966.exe
      4⤵
      PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46418.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
        5⤵
        
        PID:15816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2392.exe
      4⤵
      PID:8708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
      4⤵
      PID:13556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
      4⤵
      PID:17372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        5⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65411.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        7⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46330.exe
        7⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29330.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30148.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        6⤵
        
        PID:10624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        6⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33735.exe
        6⤵
        
        PID:708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55058.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2718.exe
        6⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        6⤵
        
        PID:16456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56890.exe
        5⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        5⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe
        5⤵
        
        PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29201.exe
      4⤵
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2178.exe
        5⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        6⤵
        
        PID:14332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42733.exe
        6⤵
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38046.exe
        5⤵
        
        PID:220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16764.exe
      4⤵
      PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        5⤵
        
        PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exe
      4⤵
      PID:12120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
      4⤵
      PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19762.exe
      4⤵
      PID:4024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4584.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        5⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34343.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24809.exe
        6⤵
        
        PID:16892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        6⤵
        
        PID:17656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56225.exe
        5⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52490.exe
        5⤵
        
        PID:17148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39928.exe
        5⤵
        
        PID:17520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
      4⤵
      PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43279.exe
        5⤵
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
        5⤵
        
        PID:17916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
      4⤵
      PID:10680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29574.exe
      4⤵
      PID:17060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7265.exe
    3⤵
    PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
      4⤵
      PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        5⤵
        
        PID:15344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-299.exe
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
      4⤵
      PID:10460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44601.exe
      4⤵
      PID:14832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38046.exe
      4⤵
      PID:2968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
    3⤵
    PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      4⤵
      PID:14176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
      4⤵
      PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48028.exe
    3⤵
    PID:10996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41889.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
    3⤵
    PID:7848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47546.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47546.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21859.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44163.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe
        8⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5406.exe
        9⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        10⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37829.exe
        10⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
        9⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33500.exe
        9⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1701.exe
        9⤵
        
        PID:17260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17403.exe
        9⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-97.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-97.exe
        8⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3206.exe
        9⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        9⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45701.exe
        8⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        8⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        9⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9189.exe
        8⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1701.exe
        8⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52380.exe
        8⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
        7⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
        7⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        7⤵
        
        PID:17560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31941.exe
        6⤵
        Executes dropped EXE
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        8⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        9⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26781.exe
        9⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        8⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        8⤵
        
        PID:16020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16020 -s 436
        9⤵
        Program crash
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
        7⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31705.exe
        7⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54347.exe
        7⤵
        
        PID:16572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21441.exe
        7⤵
        
        PID:12968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
        6⤵
        
        PID:13576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62922.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10154.exe
        8⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        9⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        9⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7285.exe
        9⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        8⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        8⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        8⤵
        
        PID:17092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5535.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58130.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4446.exe
        8⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        8⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        7⤵
        
        PID:12524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41623.exe
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9734.exe
        8⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8964.exe
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe
        7⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        7⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        7⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        6⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        7⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        7⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
        7⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2688.exe
        6⤵
        
        PID:15776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16397.exe
        6⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
        5⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20849.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19299.exe
        8⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        8⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48216.exe
        8⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
        7⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        7⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        6⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4077.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11965.exe
        6⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        7⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        7⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        6⤵
        
        PID:17684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61778.exe
        5⤵
        
        PID:12236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53955.exe
        5⤵
        
        PID:17292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5356.exe
        5⤵
        
        PID:17572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59274.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35279.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
        9⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7952 -s 648
        9⤵
        Program crash
        
        PID:16864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5252 -s 720
        8⤵
        Program crash
        
        PID:11984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 752
        7⤵
        Program crash
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe
        6⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37731.exe
        7⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
        8⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe
        8⤵
        
        PID:17348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 652
        7⤵
        Program crash
        
        PID:12108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 636
        6⤵
        Program crash
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35147.exe
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        8⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        8⤵
        
        PID:17240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7285.exe
        8⤵
        
        PID:16808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        7⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        7⤵
        
        PID:17096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
        6⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23295.exe
        7⤵
        
        PID:16436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        6⤵
        
        PID:11644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        6⤵
        
        PID:16764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9564.exe
        6⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9036.exe
        6⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe
        5⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        6⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        5⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42972.exe
        5⤵
        
        PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        8⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16309.exe
        8⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        8⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5053.exe
        7⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54741.exe
        7⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34315.exe
        7⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        6⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        7⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        6⤵
        
        PID:11904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35744.exe
        6⤵
        
        PID:16832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30929.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39039.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        7⤵
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        7⤵
        
        PID:13008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe
        6⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39966.exe
        6⤵
        
        PID:15420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27428.exe
        5⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63653.exe
        5⤵
        
        PID:13884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        5⤵
        
        PID:13020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22762.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52723.exe
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44601.exe
        6⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41637.exe
        6⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
        5⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7809.exe
        6⤵
        
        PID:17384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21408.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        5⤵
        
        PID:17328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        5⤵
        
        PID:18008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
      4⤵
      PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe
        5⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44623.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
        6⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        5⤵
        
        PID:11044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        5⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3676.exe
        5⤵
        
        PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26401.exe
      4⤵
      PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
        5⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43815.exe
      4⤵
      PID:9320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8268.exe
      4⤵
      PID:16716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
      4⤵
      PID:3316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        6⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        7⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        8⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        8⤵
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27491.exe
        8⤵
        
        PID:17536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        7⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49645.exe
        7⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        7⤵
        
        PID:16736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
        7⤵
        
        PID:16964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        6⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        7⤵
        
        PID:13416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        6⤵
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55019.exe
        6⤵
        
        PID:17148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34311.exe
        6⤵
        
        PID:17880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        7⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        7⤵
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        6⤵
        
        PID:15756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48271.exe
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
        6⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
        6⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
        6⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        5⤵
        
        PID:9460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59917.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exe
        5⤵
        
        PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29223.exe
        5⤵
        
        PID:5124
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5124 -s 716
        6⤵
        Program crash
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
        5⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        6⤵
        
        PID:13568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
        5⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18509.exe
        5⤵
        
        PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
        5⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25037.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49645.exe
        6⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7357.exe
        5⤵
        
        PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56350.exe
      4⤵
      PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        5⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
      4⤵
      PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41409.exe
      4⤵
      PID:15748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe
      4⤵
      PID:17812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57825.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        6⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        7⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        7⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18649.exe
        6⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27815.exe
        7⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe
        7⤵
        
        PID:18024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
        6⤵
        
        PID:14968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exe
        6⤵
        
        PID:17736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        5⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17955.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64166.exe
        6⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        6⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
        5⤵
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64254.exe
        5⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe
      4⤵
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24025.exe
        5⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30259.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe
        6⤵
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exe
        6⤵
        
        PID:17348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17979.exe
        6⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7357.exe
        5⤵
        
        PID:16380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
      4⤵
      PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11374.exe
        5⤵
        
        PID:8744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        5⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17979.exe
        5⤵
        
        PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5681.exe
      4⤵
      PID:9816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
      4⤵
      PID:17636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12502.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        6⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37327.exe
        7⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53614.exe
        7⤵
        
        PID:17864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        6⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
        6⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
        5⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36713.exe
        5⤵
        
        PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25822.exe
        5⤵
        
        PID:17252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
      4⤵
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54467.exe
        5⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14392.exe
        5⤵
        
        PID:16524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34112.exe
      4⤵
      PID:10392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
      4⤵
      PID:14904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
      4⤵
      PID:1580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
    3⤵
    PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
      4⤵
      PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34431.exe
        5⤵
        
        PID:9952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57726.exe
        5⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47012.exe
        5⤵
        
        PID:14704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
      4⤵
      PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35168.exe
      4⤵
      PID:16116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
      4⤵
      PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
    3⤵
    PID:7304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
      4⤵
      PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
      4⤵
      PID:13652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
      4⤵
      PID:16808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
    3⤵
    PID:10424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
    3⤵
    PID:14964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60496.exe
    3⤵
    PID:5772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23896.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23896.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15574.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35147.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe
        7⤵
        
        PID:16848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
        7⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        6⤵
        
        PID:13900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28304.exe
        6⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39247.exe
        7⤵
        
        PID:16124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6309.exe
        6⤵
        
        PID:12132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15769.exe
        6⤵
        
        PID:17756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        6⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43553.exe
        6⤵
        
        PID:17276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        6⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48765.exe
        5⤵
        
        PID:16472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
      4⤵
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        6⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        7⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        7⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49542.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        6⤵
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34123.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9801.exe
        5⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        6⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42593.exe
        6⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18057.exe
      4⤵
      PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52355.exe
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        5⤵
        
        PID:14324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exe
      4⤵
      PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
      4⤵
      PID:14848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31963.exe
        5⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37207.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21395.exe
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        8⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        8⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        8⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        7⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44706.exe
        7⤵
        
        PID:16532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        7⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
        6⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24809.exe
        7⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47012.exe
        7⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        6⤵
        
        PID:17356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
        6⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14601.exe
        5⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        6⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        6⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46993.exe
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        5⤵
        
        PID:13688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17540.exe
        5⤵
        
        PID:16988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37816.exe
        5⤵
        
        PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
      4⤵
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        5⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        6⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        7⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57114.exe
        7⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        6⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        6⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
        6⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53776.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
        5⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34984.exe
        5⤵
        
        PID:12604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51689.exe
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        5⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21441.exe
        5⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38400.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
      4⤵
      PID:8728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
      4⤵
      PID:13964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29911.exe
      4⤵
      PID:1744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27804.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
        5⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        6⤵
        
        PID:13584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        5⤵
        
        PID:16012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
      4⤵
      PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        5⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        5⤵
        
        PID:14052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6292.exe
      4⤵
      PID:10924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
      4⤵
      PID:16036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
    3⤵
    PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        5⤵
        
        PID:13280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
        5⤵
        
        PID:16992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
      4⤵
      PID:8996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
      4⤵
      PID:14696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
      4⤵
      PID:17728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
    3⤵
    PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2718.exe
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
      4⤵
      PID:13324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
      4⤵
      PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
    3⤵
    PID:10412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38247.exe
    3⤵
    PID:14928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
    3⤵
    PID:6992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15309.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15309.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63955.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48862.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        6⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        7⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        7⤵
        
        PID:16696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29574.exe
        6⤵
        
        PID:17012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18509.exe
        6⤵
        
        PID:14884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
        5⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58131.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        6⤵
        
        PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5681.exe
        5⤵
        
        PID:11432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        5⤵
        
        PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
      4⤵
      PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        6⤵
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        6⤵
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        5⤵
        
        PID:9900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
        5⤵
        
        PID:15008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56757.exe
        5⤵
        
        PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
      4⤵
      PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        5⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11426.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        5⤵
        
        PID:13952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        5⤵
        
        PID:352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24654.exe
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
      4⤵
      PID:13588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
      4⤵
      PID:15924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43974.exe
      4⤵
      PID:4632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe
        5⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26735.exe
        6⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
        6⤵
        
        PID:12948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39744.exe
        6⤵
        
        PID:17620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        5⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
        5⤵
        
        PID:15260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
        5⤵
        
        PID:16772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61446.exe
      4⤵
      PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        5⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        5⤵
        
        PID:13868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30028.exe
      4⤵
      PID:10444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
      4⤵
      PID:14860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
      4⤵
      PID:3688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
    3⤵
    PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
      4⤵
      PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        5⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        5⤵
        
        PID:13984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65422.exe
        5⤵
        
        PID:15744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50170.exe
      4⤵
      PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53227.exe
        5⤵
        
        PID:16560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46190.exe
      4⤵
      PID:15440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
      4⤵
      PID:4436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
    3⤵
    PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      4⤵
      PID:14208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exe
      4⤵
      PID:3780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
    3⤵
    PID:11204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
    3⤵
    PID:16176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39500.exe
    3⤵
    PID:6060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38305.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38305.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46379.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32155.exe
      4⤵
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27695.exe
        5⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
        7⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35056.exe
        7⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21441.exe
        6⤵
        
        PID:12452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
        6⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exe
        5⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
        5⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35076.exe
        5⤵
        
        PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2349.exe
      4⤵
      PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
        5⤵
        
        PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        5⤵
        
        PID:15352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        5⤵
        
        PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14128.exe
      4⤵
      PID:9332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
      4⤵
      PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21480.exe
      4⤵
      PID:16868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21609.exe
    3⤵
    PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23611.exe
      4⤵
      PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        5⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48296.exe
        6⤵
        
        PID:17716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        5⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        5⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        5⤵
        
        PID:17272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe
        5⤵
        
        PID:17676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
      4⤵
      PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
      4⤵
      PID:13912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
      4⤵
      PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62129.exe
      4⤵
      PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19784.exe
    3⤵
    PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
      4⤵
      PID:12092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53398.exe
      4⤵
      PID:17084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9853.exe
    3⤵
    PID:9796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48241.exe
    3⤵
    PID:14952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34462.exe
    3⤵
    PID:1120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65019.exe
    3⤵
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
      4⤵
      PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        5⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
        5⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
        5⤵
        
        PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
      4⤵
      PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43921.exe
      4⤵
      PID:13244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62513.exe
      4⤵
      PID:7496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
    3⤵
    PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3154.exe
      4⤵
      PID:9936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
      4⤵
      PID:14940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
    3⤵
    PID:9608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
    3⤵
    PID:14868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
    3⤵
    PID:17788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
  2⤵
  PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
    3⤵
    PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      4⤵
      PID:14168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
      4⤵
      PID:3552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
    3⤵
    PID:11324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12392.exe
    3⤵
    PID:17268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
  2⤵
  PID:7656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
    3⤵
    PID:13212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22314.exe
    3⤵
    PID:17388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
    3⤵
    PID:5916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42693.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42693.exe
  2⤵
  PID:10904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
  2⤵
  PID:15956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18845.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18845.exe
  2⤵
  PID:17856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5124 -ip 5124
1⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4268 -ip 4268
1⤵
PID:7764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 868 -ip 868
1⤵
PID:8344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5676 -ip 5676
1⤵
PID:10364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5252 -ip 5252
1⤵
PID:11640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 7952 -ip 7952
1⤵
PID:16712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 16020 -ip 16020
1⤵
PID:16972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe

Filesize
468KB

MD5
f85ddaee61784efbacd8eb67903445e1

SHA1
c7c2be6e0df1b70d96b7069cb4dcfd2fab3a9a0f

SHA256
7fb6c7e8f52de25f5f4a6a38f9ab65bdaa54d0da3aeae1d5c25c10b36b2d130f

SHA512
87eb720de4a7e445f4238b81eb1f64372c519820adffe70f3cbfb47099f3e48a99d132645b46554bc6f907e8e34fe45f04b606a218de84d634b9fc98abcce28b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15309.exe

Filesize
468KB

MD5
1e6991cabff696e6d28b5b5a871023b1

SHA1
41de4bbbc24bbd88a466a32d984c36b3be8eb5ad

SHA256
9042a0c957194cce2b6b91718dadddc57115d368420e5b89453c390df975ebb3

SHA512
edfd7ea97dedf493eb6416a919171931c64c4584ac06ffbffdade9fa55b1b03bb3bce0e648944a1f8d6c0d7f0a0db007cac9c90af1eaeae17cf83558e4c4c285

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15574.exe

Filesize
468KB

MD5
d4d18565dbd6b8a496e7e1c37ddbe5fa

SHA1
eccbe79a59024752fcf90fe26644107a99e85e10

SHA256
d11e7db7d322737c59560f6fe73932420bffcb2e639ead13493b708000b65b8e

SHA512
44986310facc9b1489737237748883b6b35741a6e7871fd691a53b5acd8276a933f4259709768e25d3b118a63cd4a207bc08f0f5babce7cee4937472fd1ed473

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21859.exe

Filesize
468KB

MD5
de5f9b548ed7cad6c096aa4b80083885

SHA1
934a3adba9eff61ae41a2d1ce811d1045bcec683

SHA256
dc210ba0def519742dc2bf36b30c939d0f5f1576f9f5a2fd9e4d6ecc1f13d6d9

SHA512
97039d238c4e7cfde2fb1a6144741e4aeb3405ef4fff9be6965369c512a7d30f0a0625acf514849bcc2d0dcb74318069aeab616f893668527eb87446456f9473

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe

Filesize
468KB

MD5
f761328d4b14cdf383f8843e3b00016d

SHA1
9aedce962836c3d5e511ce6250e63fdacdbdc588

SHA256
8df7b2993d1e384e085fb91ab7456144aeaa3607afeefd7832859a2d43ecf915

SHA512
f65eb47b2405816b3e2e0c739f4dc867cbfe0cb7cf80ae04c317ceaaabb3d66920a5f38486fee3b1cb45d60f84de07aa892d3049f33227bed9b0832b660ba5c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23896.exe

Filesize
468KB

MD5
c73b7256b0bd41c96ba5d8e19707401d

SHA1
aeb3166c05c84da916e0dc84bec8096d230fe57f

SHA256
a0057f87a1cb44fbe5d8b9ae763f2b0f7db81267fbc4274dac9ae6d159a8cd1f

SHA512
df3608e607f792a6702e7bb39ce496c61d9db72c41ea4b5fbde6805ec470b54d0ce7b5c90b8b8adf2e345a4cfd1eefce7d6bb53b43c282e1a458e9c514bc7b78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe

Filesize
468KB

MD5
c6c216aaa7e40ff579dfd33de0e2e54c

SHA1
a73479524cd6427573eaec94860a7fafb40e99e8

SHA256
8969593b1ae747bb8d9124c6d7ec24e68221aa8606dcf8ad9b2b1b4e9809470a

SHA512
be21af4681b676818fcddda1f46a83852178c986979ddf4f7f3e7c3f44ec6b20cbe736aab5192ce7f7f57b488250d8be4d4d7f0f07639deccf451a54bf9e4d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe

Filesize
468KB

MD5
16345bb0c4195afcaad80e7b4da094d8

SHA1
6868574954dd04abc6fabece5acdc62881723448

SHA256
cb78518517e81888006352ce1a80dab79ee1b10a3ceaa0354d6a998b2c792262

SHA512
fc66d47937766434db26490cef064640b347fe7d3450dc8e166c6fbebe483d56d0cbadcdcc99d670589287e31bff1408d7a80ea22193204b81a14099771d1308

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe

Filesize
468KB

MD5
7a34247f653ff14457922b21c4164199

SHA1
4e4d372c16ef3846230792852b352c4e0a89d9e5

SHA256
1007b139bb4a1f1abe296bcd778a85da3dafdfda07cb724a65e83a358e8df0f3

SHA512
e3adb461278e1401d85b893d42995dfed44d781f0c2f12f5ad34da00eaa753b2fd66728d3cf0495e3bf7a646247aff5222910cbcd6af37d4a7c8634c415202ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe

Filesize
468KB

MD5
d9eed8b3c64e2cc45ceebfa994d7ffe2

SHA1
726ff1be533a5906091bb2872552a1d97a4b1742

SHA256
834515047a4835107f561e4e9bf5de54d29eb070cc40200e26efca5897c8d796

SHA512
b50467c05d4fd8d377029609bbb13797da10056caba6080c4552a84c2c7552fbf99e68fbeda3c7cd9c80ac14f27f476e5caca33779ad59569daa4a06e4e846cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3465.exe

Filesize
468KB

MD5
c467b8b7c7e4e85765d7893172aa8fa4

SHA1
b60432b300ba8844aaa3fd84a729b6dd44916ae4

SHA256
5a728dc01728a1e3ac141d9e0841b222b1ed4ed0da86c7ce2c59023c5a6c0f01

SHA512
813c97a07c0e26c28bcd01feceb2c21d2dcfd90cd511307b4a1d0794ea33f28f1114c1e3a54c1213557a42d17f55a8ca1143d760b1789d5310be51bcca349248

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3498.exe

Filesize
468KB

MD5
b70b746245044dca58e77de75c25844c

SHA1
df818b752ffca3fe50550abb12c9207b6135aab0

SHA256
ba52cd95c4c9d67ee6c4b977d5e819a41dd0dd117343a432f0814b4a0965bdbe

SHA512
21cba4b789210bd827a6176f11e8efc6513119aefb512438cd8c7030812afa1de058e96937a03140ccb2396e2933507e916f653e756fc30d41b32839b5380546

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe

Filesize
468KB

MD5
59bd60cf852ebc73afeefbedd19343af

SHA1
055b58860557436c4f7d387c577601e8fc61b126

SHA256
7bd15822a338dfa86a281862ed460ac9e77d73073ef06a80fcbd2f2a75e2b60e

SHA512
eecb8c32ce1b4e0563819cb90a8ed759685c112c30bc0c8408d3a76ec5d1eeef621f7354dbe5ced354c066820bba2d788ca37ec4245d9aa039944b7d6fdd23f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe

Filesize
468KB

MD5
d4529c0c88e44db67df9be07bfbbbff3

SHA1
22decff2e9bddf39187bf904a696c4a0701bad22

SHA256
657f3cf748672baf1577ca7f8f3f2d306f16b330076ef0a6d7125dc2a1cd73af

SHA512
e370b3f6b9fff0fb969f83ee0876e8601661d1a780bf686428e743e255b0cca376d975fa0be0705dc4f951b2e31316143661216b68cf63bacb3cda501456093c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38305.exe

Filesize
468KB

MD5
c68d8e047776449b8bed722dd8036ed2

SHA1
0009b2a4ee723c8be6df666eb2aeae83a28ae4f2

SHA256
5a724e7bf80ef180ef689588df1d53b9994372695eff89a9fde9c54d26788896

SHA512
e01188f44e1088b73efafec9debff16b4d35ab40d944e6a40a5edec8ea1aba0a4673e8be66bbd9a5a2be0d3a5a03ac6bacf419991213ff738a32f01aff949cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39259.exe

Filesize
468KB

MD5
2f4485c68af1906d088b2730fbc8f069

SHA1
07882f2aa9f16529902746f67ee556fb607ce661

SHA256
47b3c732dd64ee398685aabcd4f9cef02116e6fd73380283c44bacf164dcdee6

SHA512
b2450c60e0555adeb1d07bbcdcd5c9a9b6d12ce6673970f06b8a494bb3f98ce1e8219c4c737b6d4395b02ed62e1c802899067c6e157c428636d4bef8e293ce2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe

Filesize
468KB

MD5
b758c48b99d7546ebe21b90db78feb12

SHA1
39c6851cb6d819d47cc371812b64a53f62c20678

SHA256
bf64f29890b7765f0e3f8c510873c5bc3c14813efc9c64fdab8e26ecbdfd1438

SHA512
612d8daec6f5f004e8dc3ca123996a394e587bd47d48bf1518dd7684dbdb424ce2dd86d44c6719067fb62d69455a98dcba3b51b7c9793d0fcbbb6991a949c8ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe

Filesize
468KB

MD5
20d20182d5c2928a484ed879a606f5d5

SHA1
36447e77b3de971091dc933b2fc4d6438a26e597

SHA256
82aeafd145ad2ce22532e2adce0654fb29500407b74ed6088808d98d10295f3f

SHA512
1a99e1db0c14b130c20bd0b83e694b743bfbca197564f40e714065cbf1c5709806567d0c80c7fd3ae09534789478d86eab6b183490d8c31be61977f34f5e56a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe

Filesize
468KB

MD5
ea79495f04d0f76859553e27dc6221b8

SHA1
6001103349509d31a2cc72ab1bbe52af73a17d67

SHA256
8d3bc9647eaf7694e0652c90cc734371ea0485d558b7e0b96c9b777a7d658489

SHA512
55695662c9a5e24cdb9061443c961432df63b7483f4ffeb37dc49c7fff0a4ea8ef7a5b7468e88fb279c8547d256b061b3471739ae48d11ddbd3bacf7dc3c897e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44163.exe

Filesize
468KB

MD5
9f2f6bf52ca5929d66f39503142d3dd0

SHA1
fec14604e581b2ef6e027a37d0d45c7b804a180c

SHA256
8177692a1f970edc3df53a6e84efb31f2a7e4889e4656cefa27813e6f4779b19

SHA512
82be525f80ce6a550422a4e351faa38c4da2e00dcdf21f2f39721d4c4f2c41a4e9f443bcc3e9f48888b026ed1bee7ccd3d4d4a1a6d9ad7f820a3eddee6547091

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe

Filesize
468KB

MD5
b99a65b2fda3702af43ef130a3e6b376

SHA1
756ca2033514405c9780024d46c9e810e7c8b0ad

SHA256
b666b7d3dccd0c4150c23888eec40598c8086f9fe914e77da91bdadbf4c13f45

SHA512
784c026edb7c2b496c5a3b059f021ffbdd721298e2ee2176d6a8ac8b5007e363841290b2deeaf7cb9641bcdfa0752d962e3e826413f19f037094ff75e0c18a2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe

Filesize
468KB

MD5
1900b2c954da2438a0010800a4d701fa

SHA1
50099b3efc788dd234957531b59e88e5a1153a85

SHA256
4df134f0d0f5bb7163b970b4f45bfcc71be3c2f8c94c5b5c6d5cd115ac0faec1

SHA512
ddaa0e4d5eb7e79c574b9a609bc5b89a96db760372f534c57ecfefaffae9f9d39cb1f9e283037a3b4639f2851f468e60d8927d6175c194c0266a9d22f7c847cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47546.exe

Filesize
468KB

MD5
cf5715e020b0a4828a4a29ca73ace03b

SHA1
6d376348aa460b387643bac7d12037e1d24b2692

SHA256
5f34960d54414c755bae7357f2a4454e0b78aba6bc96c131bcd48937f076483f

SHA512
0c2e3f2c926f47b3075998e54ae65a015b3d89957a9a153425c05447ae56b9f519213ed0f571e4f33387ab4383512c07db63882f9aca129a6639b3472636005c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe

Filesize
468KB

MD5
4c937662ae10fb94c080d144ea9db410

SHA1
9d205e7604ec0eba45fbff5ac622c1ecbbd5540e

SHA256
155ca2f2f75a3ad6db3c8772062c5653bb0242e5245f3a29da1b8345b23acb0c

SHA512
c157ddb5c40c16f47b0f8511a684e5927f0f1c023b9bc4a04f692d679f783ed10c97bfddfca9ea15950e140c1e706e6af1ee7357fb49ea737ec1a8b24af3dbf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51961.exe

Filesize
468KB

MD5
cc68df76530859ca84908d9bbc5a655f

SHA1
615bba1c5d8abac1b17ee8b5b91d70172021c84b

SHA256
db0cbb1a229323f7d92e6f574c4624fd3b191aa12c28fc6b791a4521a0ff9e8f

SHA512
0108c191f7518d4bc8dcd3d17c93f2bd3073fecf0b31272b329c659b6eab9e4cda93ab569aba61868ce11463a18925212542a5798fe1e0f1c1db87b6bb05a39e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe

Filesize
468KB

MD5
b4c7cb5d503baf919dfa3a9fdf5c5dfd

SHA1
bc14089d9dce38c24d2a645397aebf5f6fdff4a3

SHA256
675e4cff3aae9ab95994c873bef23f1ed3d890269388ac506797901bad31cb9b

SHA512
965d8f462c2f7650e01e09766a4c915f21a32ad1600a5698742148bec04a182fac7f63b84543aa14c29ba6d0bbf650f877d0c0e0406121da2f1fa93370308c81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57825.exe

Filesize
468KB

MD5
6f1f4bf0b4435a30636aac792e6e3727

SHA1
3bac126c333652a4a1d92d12b28f226bd5ee2d34

SHA256
fb1048a90c6d0b0eb9353cf3c7ffa97a152bfbbc610f6826507bd3d9fa618276

SHA512
491235220c5c77bac98d188eb80a0274c9a0ab947604aa322fb4ae1e8a56b000bd8f18c0b687b32f0fe1c1821438ed01ac5a18513399b6bc2c271ba2f4358c22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59274.exe

Filesize
468KB

MD5
283411090d3a8c5c937cada96365ed17

SHA1
856e403d9a7a47b35f4573bebf8ad8d362b8fc89

SHA256
d4c5dcb0fab1330d6f527653e5fe4b99e0cd2ac4e6b58a336d68da7195aab15f

SHA512
6f9cb99802419eda022675404869f7663a1eb90483a10c7f34341232b28200f6803834301196f2bfcfe3cbc6584a0847b15b35317b357276124a41e5f81e2c54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62922.exe

Filesize
468KB

MD5
0ce10c101765ffff6f387434de421d70

SHA1
5b59c253f653505211bacac27724df158b814494

SHA256
8fe6cf4afedb09ce2f3b7facd9d7245c84e95ab4b390c4c3ebcf47cbd05b3c6c

SHA512
dcd52654c00bf4c374f684a706cc4d8f47cf93c8218fce42356837ccca7f96c7ad60b95db5bebfaab0d84ecda2d0d77b719ea3d278fccc3cd58ba247929a1a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63955.exe

Filesize
468KB

MD5
f54c114ea81e989cbc55efe84895cacb

SHA1
c930b7e2a4c001c9a134bd4b5e7dda40b917e08f

SHA256
c8f291e6137bab42d8a41ccd7e8b0838ec81667efe4ea2aa3445bcdb7d437bd4

SHA512
0a29b1f366508ac5a5a7686201e45be11bc6d0e4f64f32ba3f548740af1225067ea9a1b7dfdace6ba6a7a3c047cb7f73b44da1f335e53b8de8f5faa8668624a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe

Filesize
468KB

MD5
d07a4b918665717456aca2b0c5cd771b

SHA1
45ab08d85343f191d692b307e1de7fb15ef81372

SHA256
e3521ec5844529d07b9e2e9615b1b55d85ff5d9b4342d47bcf85660e88ff92b0

SHA512
2bb5be3102ac4db502281c65d6f581e87544d0eff1ecf925e44319045dd1634e165f2177d702f8ec9e44447ff98ca5c327ed7369e456e5bd7236566db9cc2438

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe

Filesize
468KB

MD5
ba5176eb7abc485b29c3e94259bfe50e

SHA1
27759dc3ee9dd5513a7ddf7dd5dc00d63775bdaa

SHA256
3e59936ea5d1a86bf2c1ebec8acc74c30d9e0b3c01bd9ad1c1e75011960cad1c

SHA512
e1b84445642c8da25fb0615b2456097e7c1e217a1d927a57ec1e8544f7288b8ebcff27636c8431f3ae94cf4f6d62e67167aee7267498e09ee9dc06cee327a311

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe

Filesize
468KB

MD5
c04167599d34d45412e3caca40702a43

SHA1
bcc2bd885010d0a44342f36f365e5a350ff81259

SHA256
52e852f7eb86ff91917f1afd4fff99c052cd44de6a06ade9b0052d7681899d06

SHA512
a508ef634f7a9ac350349b83fdce7057c6f4ed4a112787e5d53777770f7ae3014db1210b31a6798402a5c092d2f7cd7b95ade8f5e7c41d64843c38fc14d3fbde

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads