12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02

Analysis

max time kernel
147s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe
Size

468KB
MD5

8d770be309e7fab3125164a3207a2673
SHA1

4a1f31a449fa19ec58036ee8267550136ea98038
SHA256

12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02
SHA512

79fde75dc17da6f671625a46ded6d33b20f40b0032bb7bdce6dee4bb92d52ea3b9fa3699f69f692ce75dedb7ed52c115e5a83849b9314c3939ebe899e33e76ad
SSDEEP

3072:8q28ogWxj28U2bYcPz3gqf8/lCZjG4plPmHx3/HSvOg+tAoN+1lS:8qRoxXU2XPDgqf0EcavOXyoN+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1412	Unicorn-45386.exe
876	Unicorn-23980.exe
1360	Unicorn-51177.exe
1656	Unicorn-57804.exe
1652	Unicorn-35246.exe
2428	Unicorn-15380.exe
2212	Unicorn-7325.exe
3936	Unicorn-41214.exe
2572	Unicorn-11042.exe
2968	Unicorn-2127.exe
3368	Unicorn-12988.exe
4544	Unicorn-63580.exe
4380	Unicorn-10295.exe
4456	Unicorn-40757.exe
992	Unicorn-34891.exe
4988	Unicorn-58702.exe
4136	Unicorn-47005.exe
1256	Unicorn-17670.exe
2564	Unicorn-23791.exe
2328	Unicorn-27784.exe
1736	Unicorn-40590.exe
4684	Unicorn-24276.exe
3492	Unicorn-5536.exe
2584	Unicorn-44696.exe
968	Unicorn-32998.exe
548	Unicorn-18054.exe
4460	Unicorn-30860.exe
4800	Unicorn-41796.exe
1108	Unicorn-44596.exe
5024	Unicorn-50726.exe
4516	Unicorn-6377.exe
1392	Unicorn-10461.exe
1456	Unicorn-923.exe
3592	Unicorn-54763.exe
4676	Unicorn-9091.exe
2416	Unicorn-2961.exe
320	Unicorn-51805.exe
4896	Unicorn-64322.exe
3532	Unicorn-44457.exe
3296	Unicorn-25982.exe
5012	Unicorn-45848.exe
4052	Unicorn-5370.exe
704	Unicorn-19105.exe
1380	Unicorn-3253.exe
512	Unicorn-11421.exe
5028	Unicorn-49554.exe
3172	Unicorn-46787.exe
2716	Unicorn-48178.exe
3788	Unicorn-44094.exe
4492	Unicorn-21536.exe
3720	Unicorn-58384.exe
3796	Unicorn-5754.exe
1220	Unicorn-37872.exe
744	Unicorn-13922.exe
3372	Unicorn-46040.exe
4072	Unicorn-50124.exe
2080	Unicorn-24658.exe
4688	Unicorn-43994.exe
1840	Unicorn-62376.exe
4972	Unicorn-38426.exe
2960	Unicorn-5510.exe
3892	Unicorn-14327.exe
1844	Unicorn-18412.exe
4388	Unicorn-10798.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
8072	5908	WerFault.exe	205
15656	14748	WerFault.exe	719
16016	14584	WerFault.exe	709
17648	7304	WerFault.exe	309
8956	12412	WerFault.exe	793
8980	4212	WerFault.exe	807
11736	7900	WerFault.exe	920
2520	6904	WerFault.exe	948
2692	6520	WerFault.exe	882
13084	17332	WerFault.exe	1012

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51384.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5796	dwm.exe
Token: SeChangeNotifyPrivilege	5796	dwm.exe
Token: 33	5796	dwm.exe
Token: SeIncBasePriorityPrivilege	5796	dwm.exe
Token: SeCreateGlobalPrivilege	18348	dwm.exe
Token: SeChangeNotifyPrivilege	18348	dwm.exe
Token: 33	18348	dwm.exe
Token: SeIncBasePriorityPrivilege	18348	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4364	12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe
1412	Unicorn-45386.exe
876	Unicorn-23980.exe
1360	Unicorn-51177.exe
1656	Unicorn-57804.exe
2212	Unicorn-7325.exe
1652	Unicorn-35246.exe
2428	Unicorn-15380.exe
3936	Unicorn-41214.exe
2572	Unicorn-11042.exe
2968	Unicorn-2127.exe
992	Unicorn-34891.exe
4544	Unicorn-63580.exe
4456	Unicorn-40757.exe
4380	Unicorn-10295.exe
3368	Unicorn-12988.exe
4988	Unicorn-58702.exe
4136	Unicorn-47005.exe
2564	Unicorn-23791.exe
1256	Unicorn-17670.exe
2328	Unicorn-27784.exe
1736	Unicorn-40590.exe
3492	Unicorn-5536.exe
4684	Unicorn-24276.exe
2584	Unicorn-44696.exe
548	Unicorn-18054.exe
5024	Unicorn-50726.exe
968	Unicorn-32998.exe
1108	Unicorn-44596.exe
4460	Unicorn-30860.exe
4800	Unicorn-41796.exe
4516	Unicorn-6377.exe
1392	Unicorn-10461.exe
1456	Unicorn-923.exe
3592	Unicorn-54763.exe
4676	Unicorn-9091.exe
2416	Unicorn-2961.exe
5012	Unicorn-45848.exe
4896	Unicorn-64322.exe
320	Unicorn-51805.exe
3296	Unicorn-25982.exe
3532	Unicorn-44457.exe
4052	Unicorn-5370.exe
704	Unicorn-19105.exe
1380	Unicorn-3253.exe
512	Unicorn-11421.exe
5028	Unicorn-49554.exe
3172	Unicorn-46787.exe
3788	Unicorn-44094.exe
3720	Unicorn-58384.exe
3796	Unicorn-5754.exe
2716	Unicorn-48178.exe
1220	Unicorn-37872.exe
4492	Unicorn-21536.exe
744	Unicorn-13922.exe
3372	Unicorn-46040.exe
2960	Unicorn-5510.exe
2080	Unicorn-24658.exe
4072	Unicorn-50124.exe
4972	Unicorn-38426.exe
1840	Unicorn-62376.exe
4688	Unicorn-43994.exe
1844	Unicorn-18412.exe
4184	Unicorn-41524.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 1412	4364	12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe	86
PID 4364 wrote to memory of 1412	4364	12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe	86
PID 4364 wrote to memory of 1412	4364	12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe	86
PID 1412 wrote to memory of 876	1412	Unicorn-45386.exe	87
PID 1412 wrote to memory of 876	1412	Unicorn-45386.exe	87
PID 1412 wrote to memory of 876	1412	Unicorn-45386.exe	87
PID 4364 wrote to memory of 1360	4364	12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe	88
PID 4364 wrote to memory of 1360	4364	12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe	88
PID 4364 wrote to memory of 1360	4364	12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe	88
PID 876 wrote to memory of 1656	876	Unicorn-23980.exe	89
PID 876 wrote to memory of 1656	876	Unicorn-23980.exe	89
PID 876 wrote to memory of 1656	876	Unicorn-23980.exe	89
PID 1360 wrote to memory of 1652	1360	Unicorn-51177.exe	90
PID 1360 wrote to memory of 1652	1360	Unicorn-51177.exe	90
PID 1360 wrote to memory of 1652	1360	Unicorn-51177.exe	90
PID 1412 wrote to memory of 2428	1412	Unicorn-45386.exe	91
PID 1412 wrote to memory of 2428	1412	Unicorn-45386.exe	91
PID 1412 wrote to memory of 2428	1412	Unicorn-45386.exe	91
PID 4364 wrote to memory of 2212	4364	12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe	92
PID 4364 wrote to memory of 2212	4364	12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe	92
PID 4364 wrote to memory of 2212	4364	12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe	92
PID 1656 wrote to memory of 3936	1656	Unicorn-57804.exe	93
PID 1656 wrote to memory of 3936	1656	Unicorn-57804.exe	93
PID 1656 wrote to memory of 3936	1656	Unicorn-57804.exe	93
PID 876 wrote to memory of 2572	876	Unicorn-23980.exe	94
PID 876 wrote to memory of 2572	876	Unicorn-23980.exe	94
PID 876 wrote to memory of 2572	876	Unicorn-23980.exe	94
PID 1652 wrote to memory of 2968	1652	Unicorn-35246.exe	95
PID 1652 wrote to memory of 2968	1652	Unicorn-35246.exe	95
PID 1652 wrote to memory of 2968	1652	Unicorn-35246.exe	95
PID 1360 wrote to memory of 3368	1360	Unicorn-51177.exe	96
PID 1360 wrote to memory of 3368	1360	Unicorn-51177.exe	96
PID 1360 wrote to memory of 3368	1360	Unicorn-51177.exe	96
PID 2428 wrote to memory of 4544	2428	Unicorn-15380.exe	97
PID 2428 wrote to memory of 4544	2428	Unicorn-15380.exe	97
PID 2428 wrote to memory of 4544	2428	Unicorn-15380.exe	97
PID 2212 wrote to memory of 4380	2212	Unicorn-7325.exe	98
PID 2212 wrote to memory of 4380	2212	Unicorn-7325.exe	98
PID 2212 wrote to memory of 4380	2212	Unicorn-7325.exe	98
PID 4364 wrote to memory of 4456	4364	12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe	99
PID 4364 wrote to memory of 4456	4364	12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe	99
PID 4364 wrote to memory of 4456	4364	12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe	99
PID 1412 wrote to memory of 992	1412	Unicorn-45386.exe	100
PID 1412 wrote to memory of 992	1412	Unicorn-45386.exe	100
PID 1412 wrote to memory of 992	1412	Unicorn-45386.exe	100
PID 3936 wrote to memory of 4988	3936	Unicorn-41214.exe	101
PID 3936 wrote to memory of 4988	3936	Unicorn-41214.exe	101
PID 3936 wrote to memory of 4988	3936	Unicorn-41214.exe	101
PID 1656 wrote to memory of 4136	1656	Unicorn-57804.exe	102
PID 1656 wrote to memory of 4136	1656	Unicorn-57804.exe	102
PID 1656 wrote to memory of 4136	1656	Unicorn-57804.exe	102
PID 2572 wrote to memory of 1256	2572	Unicorn-11042.exe	103
PID 2572 wrote to memory of 1256	2572	Unicorn-11042.exe	103
PID 2572 wrote to memory of 1256	2572	Unicorn-11042.exe	103
PID 876 wrote to memory of 2564	876	Unicorn-23980.exe	104
PID 876 wrote to memory of 2564	876	Unicorn-23980.exe	104
PID 876 wrote to memory of 2564	876	Unicorn-23980.exe	104
PID 2968 wrote to memory of 2328	2968	Unicorn-2127.exe	105
PID 2968 wrote to memory of 2328	2968	Unicorn-2127.exe	105
PID 2968 wrote to memory of 2328	2968	Unicorn-2127.exe	105
PID 1652 wrote to memory of 1736	1652	Unicorn-35246.exe	106
PID 1652 wrote to memory of 1736	1652	Unicorn-35246.exe	106
PID 1652 wrote to memory of 1736	1652	Unicorn-35246.exe	106
PID 992 wrote to memory of 4684	992	Unicorn-34891.exe	107

C:\Users\Admin\AppData\Local\Temp\12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe
"C:\Users\Admin\AppData\Local\Temp\12f48d56659fb2b2151a5411d6bffc21827ea2021d08bf3451c9e22b4f21fe02.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45386.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45386.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41214.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58702.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14327.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
        9⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14213.exe
        10⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45758.exe
        11⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        10⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12336.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        9⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        10⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        10⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        9⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48021.exe
        9⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        9⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        8⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
        9⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        9⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8616.exe
        9⤵
        
        PID:16932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62904.exe
        8⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39299.exe
        8⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        8⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10798.exe
        7⤵
        Executes dropped EXE
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        9⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
        10⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        10⤵
        
        PID:17260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        9⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        9⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
        9⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43356.exe
        8⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
        8⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23324.exe
        8⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
        8⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        7⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        8⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        8⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        8⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
        7⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12679.exe
        7⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46086.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
        7⤵
        
        PID:17572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20742.exe
        7⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25786.exe
        8⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        9⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15909.exe
        10⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        9⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        9⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45865.exe
        9⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1171.exe
        8⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2441.exe
        8⤵
        
        PID:14748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14748 -s 464
        9⤵
        Program crash
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        8⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
        8⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60155.exe
        8⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
        8⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        8⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15265.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        7⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        7⤵
        
        PID:15888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12857.exe
        6⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57820.exe
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        8⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        8⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        7⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39774.exe
        7⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        7⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        7⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17482.exe
        6⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1935.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19506.exe
        7⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
        7⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        7⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        7⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14316.exe
        6⤵
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14758.exe
        6⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47005.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18412.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        9⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        9⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
        8⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49674.exe
        8⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12412 -s 464
        9⤵
        Program crash
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51421.exe
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58152.exe
        8⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        9⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        9⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
        9⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47903.exe
        8⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16804.exe
        8⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62213.exe
        8⤵
        
        PID:16544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        7⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        7⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61067.exe
        7⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        7⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe
        8⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        8⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4768.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15728.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54481.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5694.exe
        8⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        7⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48021.exe
        7⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51896.exe
        7⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27823.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        7⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37396.exe
        7⤵
        
        PID:16964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2272.exe
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
        6⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23854.exe
        6⤵
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15059.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        6⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38962.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe
        8⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        8⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        9⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
        9⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43511.exe
        9⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
        8⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2708.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        7⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13210.exe
        7⤵
        
        PID:15920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12617.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12433.exe
        7⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        7⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54216.exe
        6⤵
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55464.exe
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50947.exe
        7⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56152.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        7⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        6⤵
        
        PID:13824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        6⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1199.exe
        5⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32982.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
        5⤵
        
        PID:14436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        5⤵
        
        PID:16568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11042.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
        7⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1281.exe
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43596.exe
        9⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        10⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exe
        10⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        10⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        9⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        9⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56901.exe
        9⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe
        8⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17224.exe
        9⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47034.exe
        9⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        9⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        9⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        8⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
        8⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51421.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
        9⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
        9⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        9⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        8⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        8⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34115.exe
        8⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65528.exe
        7⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37742.exe
        7⤵
        
        PID:16444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7098.exe
        6⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38054.exe
        8⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        8⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
        8⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
        8⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21016.exe
        7⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48021.exe
        7⤵
        
        PID:16076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43596.exe
        7⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        8⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52172.exe
        8⤵
        
        PID:17252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        7⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50862.exe
        6⤵
        
        PID:11424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44531.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37742.exe
        6⤵
        
        PID:16472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        6⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 636
        7⤵
        Program crash
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        6⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17800.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48186.exe
        7⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        7⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        6⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56748.exe
        6⤵
        
        PID:17024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48052.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29782.exe
        6⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9622.exe
        6⤵
        
        PID:14328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe
        6⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26393.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50862.exe
        5⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8069.exe
        5⤵
        
        PID:15208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23791.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-923.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4021.exe
        6⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61276.exe
        8⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        9⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        9⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65036.exe
        9⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        8⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47723.exe
        8⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
        8⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8353.exe
        7⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
        7⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
        7⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
        7⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        7⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12972.exe
        7⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51384.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48021.exe
        6⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        6⤵
        
        PID:440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59807.exe
        5⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        7⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
        8⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        8⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28252.exe
        8⤵
        
        PID:17332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17332 -s 464
        9⤵
        Program crash
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        7⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        7⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        6⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        6⤵
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53588.exe
        6⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        6⤵
        
        PID:15172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65156.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        6⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exe
        6⤵
        
        PID:12404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24575.exe
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43497.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63775.exe
        6⤵
        
        PID:14312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
        6⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7900 -s 464
        7⤵
        Program crash
        
        PID:11736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50862.exe
        5⤵
        
        PID:11344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        5⤵
        
        PID:15180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        7⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38476.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        7⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65313.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exe
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43474.exe
        6⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29529.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33923.exe
        6⤵
        
        PID:13812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        5⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38054.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        6⤵
        
        PID:17528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
        5⤵
        
        PID:12672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15732.exe
        5⤵
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52905.exe
        5⤵
        
        PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
      4⤵
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63850.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44058.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        6⤵
        
        PID:14608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        6⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        5⤵
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        5⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54835.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17049.exe
        5⤵
        
        PID:8604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
        5⤵
        
        PID:9168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        5⤵
        
        PID:16824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-105.exe
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
      4⤵
      PID:12580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1371.exe
      4⤵
      PID:6668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63580.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44696.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48178.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        9⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        9⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
        9⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        9⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        8⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        8⤵
        
        PID:16324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        8⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56974.exe
        8⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20082.exe
        8⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1428.exe
        8⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
        8⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34490.exe
        7⤵
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26724.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22792.exe
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        8⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        8⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39843.exe
        8⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        7⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
        7⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
        7⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe
        6⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2568.exe
        6⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        6⤵
        
        PID:13408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        6⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
        6⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        7⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60236.exe
        8⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36385.exe
        8⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        7⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59505.exe
        7⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exe
        7⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59693.exe
        6⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16677.exe
        7⤵
        
        PID:16884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45398.exe
        6⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11556.exe
        6⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11679.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29070.exe
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe
        6⤵
        
        PID:11372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4195.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53932.exe
        6⤵
        
        PID:16852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        5⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        5⤵
        
        PID:11060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28387.exe
        5⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
        5⤵
        
        PID:16716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32998.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1089.exe
        6⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        7⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23656.exe
        7⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        7⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        7⤵
        
        PID:12000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        6⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        7⤵
        
        PID:14428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7304 -s 668
        7⤵
        Program crash
        
        PID:17648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
        6⤵
        
        PID:13448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
        6⤵
        
        PID:17012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        6⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
        6⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe
        6⤵
        
        PID:15636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        6⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        6⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26741.exe
        5⤵
        
        PID:11556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        5⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29683.exe
        5⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
        5⤵
        
        PID:9072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43994.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        6⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
        7⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        7⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        7⤵
        
        PID:16736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29157.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55417.exe
        5⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62240.exe
        5⤵
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        5⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        5⤵
        
        PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
      4⤵
      PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe
        5⤵
        
        PID:244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        5⤵
        
        PID:11176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
        5⤵
        
        PID:14516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
        5⤵
        
        PID:536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
      4⤵
      PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        5⤵
        
        PID:13532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        5⤵
        
        PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
      4⤵
      PID:14616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32931.exe
      4⤵
      PID:16948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34891.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
        6⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        8⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
        8⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        8⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        8⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46942.exe
        8⤵
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        7⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        7⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60905.exe
        7⤵
        
        PID:12692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        7⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        7⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        7⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        6⤵
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11556.exe
        6⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30232.exe
        5⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        7⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        7⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe
        6⤵
        
        PID:17540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29211.exe
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
        5⤵
        
        PID:13148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
        5⤵
        
        PID:14756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46787.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
        5⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60508.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36108.exe
        7⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        7⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        7⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
        6⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
        5⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1351.exe
        5⤵
        
        PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        5⤵
        
        PID:12468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        6⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
        7⤵
        
        PID:17800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        6⤵
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        5⤵
        
        PID:9520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5634.exe
        5⤵
        
        PID:11188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62957.exe
      4⤵
      PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
      4⤵
      PID:9856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
      4⤵
      PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11421.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        5⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
        6⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51484.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1416.exe
        7⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
        7⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        7⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41192.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        6⤵
        
        PID:11792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7293.exe
        6⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45398.exe
        6⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
        6⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5062.exe
        6⤵
        
        PID:15744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        6⤵
        
        PID:12516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        5⤵
        
        PID:9836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63992.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
        5⤵
        
        PID:10104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58666.exe
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
        6⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4542.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        6⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        5⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57049.exe
        5⤵
        
        PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
      4⤵
      PID:8572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
      4⤵
      PID:10732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63390.exe
      4⤵
      PID:15372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25682.exe
      4⤵
      PID:16996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
      4⤵
      PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1935.exe
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19506.exe
        6⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        6⤵
        
        PID:16664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        5⤵
        
        PID:12328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        5⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30797.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
      4⤵
      PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54582.exe
        5⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        5⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
        5⤵
        
        PID:17240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
      4⤵
      PID:8768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
      4⤵
      PID:13192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe
      4⤵
      PID:6276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29292.exe
    3⤵
    PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46310.exe
      4⤵
      PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        5⤵
        
        PID:11020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        5⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        5⤵
        
        PID:16488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51551.exe
      4⤵
      PID:12120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
      4⤵
      PID:15192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
      4⤵
      PID:16524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39062.exe
    3⤵
    PID:208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
    3⤵
    PID:10740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18587.exe
    3⤵
    PID:14640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
    3⤵
    PID:16620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51177.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51177.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35246.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2127.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64322.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16677.exe
        9⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65313.exe
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15321.exe
        8⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30022.exe
        8⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe
        8⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        8⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43957.exe
        8⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        7⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe
        7⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        6⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29977.exe
        8⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50682.exe
        8⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        8⤵
        
        PID:17580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        7⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        7⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55940.exe
        6⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        7⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        7⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9562.exe
        6⤵
        
        PID:13572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40712.exe
        6⤵
        
        PID:16024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25982.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
        6⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20140.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        8⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
        8⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        8⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
        8⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27623.exe
        7⤵
        
        PID:12624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45398.exe
        7⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe
        6⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        7⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        7⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10454.exe
        7⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29813.exe
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23760.exe
        6⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        6⤵
        
        PID:15436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
        6⤵
        
        PID:17560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33051.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        6⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        7⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        6⤵
        
        PID:13080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22930.exe
        6⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        5⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10206.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        5⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        5⤵
        
        PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
        6⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38962.exe
        7⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        8⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        8⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
        8⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61613.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5037.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        7⤵
        
        PID:17656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20248.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        7⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51528.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        7⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        6⤵
        
        PID:13416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe
        6⤵
        
        PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64659.exe
        5⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14265.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15365.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe
        7⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22930.exe
        7⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        6⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
        6⤵
        
        PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11617.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3435.exe
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40349.exe
        6⤵
        
        PID:13012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
        6⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exe
        5⤵
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
        5⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61395.exe
        5⤵
        
        PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19105.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        5⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10949.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11473.exe
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11338.exe
        7⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37609.exe
        7⤵
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        7⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        6⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23506.exe
        6⤵
        
        PID:17324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        5⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        6⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15643.exe
        6⤵
        
        PID:17304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        5⤵
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
        5⤵
        
        PID:13364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64553.exe
        5⤵
        
        PID:17592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
      4⤵
      PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
        5⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        5⤵
        
        PID:15164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        5⤵
        
        PID:16704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49824.exe
      4⤵
      PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13168.exe
        5⤵
        
        PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42904.exe
      4⤵
      PID:10176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45287.exe
      4⤵
      PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
      4⤵
      PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe
      4⤵
      PID:17072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50726.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50124.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1089.exe
        6⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61686.exe
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54839.exe
        8⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13640.exe
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        8⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        7⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        7⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 456
        8⤵
        Program crash
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42972.exe
        6⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12537.exe
        7⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        7⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        6⤵
        
        PID:10380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        6⤵
        
        PID:13432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39843.exe
        6⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8634.exe
        5⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        6⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        7⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        6⤵
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe
        6⤵
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
        5⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39709.exe
        5⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        5⤵
        
        PID:14424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47318.exe
        5⤵
        
        PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exe
        5⤵
        
        PID:11392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38426.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        5⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18968.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        6⤵
        
        PID:16640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        5⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45758.exe
        6⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1351.exe
        5⤵
        
        PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        5⤵
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        5⤵
        
        PID:9108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53932.exe
        5⤵
        
        PID:16872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
      4⤵
      PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29015.exe
      4⤵
      PID:13304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
      4⤵
      PID:6464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        5⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        7⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        6⤵
        
        PID:13896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        6⤵
        
        PID:17036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25452.exe
        6⤵
        
        PID:17368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        5⤵
        
        PID:13588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19998.exe
        5⤵
        
        PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53108.exe
        5⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51523.exe
        6⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        6⤵
        
        PID:16604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        5⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12336.exe
        5⤵
        
        PID:13964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
        5⤵
        
        PID:17344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37440.exe
      4⤵
      PID:220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
      4⤵
      PID:11584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6789.exe
      4⤵
      PID:16008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61395.exe
      4⤵
      PID:1244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1089.exe
      4⤵
      PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59766.exe
        5⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        6⤵
        
        PID:13992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        6⤵
        
        PID:16512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        5⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        5⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43063.exe
        5⤵
        
        PID:17604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12769.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38246.exe
        5⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        5⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
      4⤵
      PID:10024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
      4⤵
      PID:13396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56172.exe
      4⤵
      PID:7072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8879.exe
    3⤵
    PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
      4⤵
      PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        5⤵
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51959.exe
        5⤵
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
      4⤵
      PID:14300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
      4⤵
      PID:16792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
    3⤵
    PID:8112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
    3⤵
    PID:9664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23922.exe
    3⤵
    PID:14384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
    3⤵
    PID:15832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10295.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
        5⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45350.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38054.exe
        8⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        8⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30636.exe
        8⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        8⤵
        
        PID:17588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        7⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        7⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
        7⤵
        
        PID:16864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
        6⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4871.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        6⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        6⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4753.exe
        7⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        7⤵
        
        PID:16756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48505.exe
        6⤵
        
        PID:10184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
        6⤵
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
        6⤵
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
        5⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        5⤵
        
        PID:12140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39864.exe
        5⤵
        
        PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39500.exe
      4⤵
      PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52750.exe
        5⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
        6⤵
        
        PID:11192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        6⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
        6⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58837.exe
        5⤵
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21970.exe
        5⤵
        
        PID:15936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-352.exe
      4⤵
      PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16293.exe
        5⤵
        
        PID:16580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44858.exe
      4⤵
      PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62648.exe
      4⤵
      PID:13604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57778.exe
      4⤵
      PID:16016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30860.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49823.exe
        5⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62454.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15779.exe
        7⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        7⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        6⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
        6⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21771.exe
        6⤵
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        6⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
        5⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59527.exe
        5⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39906.exe
        5⤵
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        5⤵
        
        PID:11888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27108.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        6⤵
        
        PID:14496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        6⤵
        
        PID:17048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        5⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16446.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        5⤵
        
        PID:17616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
      4⤵
      PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19288.exe
      4⤵
      PID:10828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
      4⤵
      PID:14584
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14584 -s 472
        5⤵
        Program crash
        
        PID:16016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
      4⤵
      PID:6520
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6520 -s 452
        5⤵
        Program crash
        
        PID:2692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58384.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52236.exe
      4⤵
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        5⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54481.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
        6⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        6⤵
        
        PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        5⤵
        
        PID:13880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
        5⤵
        
        PID:16984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
      4⤵
      PID:11140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
      4⤵
      PID:15064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47318.exe
      4⤵
      PID:16632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
    3⤵
    PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
      4⤵
      PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        5⤵
        
        PID:12576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
        5⤵
        
        PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
      4⤵
      PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
      4⤵
      PID:13676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33049.exe
      4⤵
      PID:2096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
    3⤵
    PID:7516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34326.exe
    3⤵
    PID:11380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe
    3⤵
    PID:15024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42853.exe
    3⤵
    PID:17224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44094.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33762.exe
        5⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44689.exe
        7⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-302.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59691.exe
        6⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15946.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
        6⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39628.exe
        6⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51550.exe
        5⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47584.exe
        5⤵
        
        PID:13704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6978.exe
        5⤵
        
        PID:13108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63481.exe
      4⤵
      PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        5⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62960.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        6⤵
        
        PID:16428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        5⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34974.exe
        5⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23307.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41551.exe
      4⤵
      PID:8428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
      4⤵
      PID:11716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50170.exe
      4⤵
      PID:4212
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 464
        5⤵
        Program crash
        
        PID:8980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57602.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65301.exe
        6⤵
        
        PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        5⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
        5⤵
        
        PID:13872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38888.exe
      4⤵
      PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54481.exe
        5⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        5⤵
        
        PID:11012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11888.exe
      4⤵
      PID:9696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
      4⤵
      PID:680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55863.exe
      4⤵
      PID:12496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
    3⤵
    PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        5⤵
        
        PID:14600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        5⤵
        
        PID:16420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
      4⤵
      PID:12164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
      4⤵
      PID:15184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
      4⤵
      PID:16696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58158.exe
    3⤵
    PID:8528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
    3⤵
    PID:12148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17056.exe
    3⤵
    PID:14860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3959.exe
    3⤵
    PID:5952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41796.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41796.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46040.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
      4⤵
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44276.exe
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        6⤵
        
        PID:13620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        6⤵
        
        PID:16680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44255.exe
        5⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        5⤵
        
        PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        5⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        5⤵
        
        PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
      4⤵
      PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        5⤵
        
        PID:14736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3718.exe
        5⤵
        
        PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
      4⤵
      PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
      4⤵
      PID:14668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56748.exe
      4⤵
      PID:16916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
    3⤵
    PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62454.exe
      4⤵
      PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37814.exe
      4⤵
      PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
      4⤵
      PID:13712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
      4⤵
      PID:16768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
    3⤵
    PID:7600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47930.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31485.exe
    3⤵
    PID:16104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19760.exe
    3⤵
    PID:5960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24658.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24658.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33762.exe
    3⤵
    PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53902.exe
      4⤵
      PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38311.exe
        5⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25207.exe
        5⤵
        
        PID:16592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
      4⤵
      PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42295.exe
      4⤵
      PID:13112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
      4⤵
      PID:15104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29536.exe
      4⤵
      PID:17060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12630.exe
    3⤵
    PID:8036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1171.exe
    3⤵
    PID:10796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53588.exe
    3⤵
    PID:14656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
    3⤵
    PID:16656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9409.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9409.exe
  2⤵
  PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
    3⤵
    PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
    3⤵
    PID:10940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47723.exe
    3⤵
    PID:14648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
    3⤵
    PID:16748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38143.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38143.exe
  2⤵
  PID:7936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
    3⤵
    PID:13864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25207.exe
    3⤵
    PID:16556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16166.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16166.exe
  2⤵
  PID:11644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:15032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
  2⤵
  PID:17212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5908 -ip 5908
1⤵
PID:7784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 14616 -ip 14616
1⤵
PID:3404

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5796

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\e12e0d2418774067b1b1e32063eb7a49 /t 3376 /p 836
1⤵
PID:8920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 7304 -ip 7304
1⤵
PID:9212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 17528 -ip 17528
1⤵
PID:10088

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:18348

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13152

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:8452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6904 -ip 6904
1⤵
PID:14252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 6520 -ip 6520
1⤵
PID:14212

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13980

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:17860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 7256 -ip 7256
1⤵
PID:13804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6268 -ip 6268
1⤵
PID:17796

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10295.exe

Filesize
468KB

MD5
42a7cc2b7a6b61c82ad3c67ad5655214

SHA1
fb663e9efe06f9d0609026391b02be9c471524a4

SHA256
29c7481533f6469a17a44587e905aa39ec0ce7d0b6746e9bcac141f07f002b08

SHA512
9aadcdda8390fc8eb615996f3e89dbb1a0c063f7338b09f9cfc73595f65436bd31b025a3f13e56cf51850db102ed35d12d1dd888da008115f8fa8ec9728940a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe

Filesize
468KB

MD5
d27467630e80b61fad20cb8a7ce0f27b

SHA1
8b4f6a49bb2d23ce999db27acf26a9603d446bd9

SHA256
7d0c4349b48dff3d6eef9d3e02d358ed94c568261f745ddbcbb3b7b849536da0

SHA512
3fd50d4a705f935973bd2848dfa2a4759f5ee0578c9fac39db1f2d1c9d520bbbc6333428563c7217dd0faeb4703b10f005ee16a55ad2925bfef35152f9063528

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11042.exe

Filesize
468KB

MD5
2c76ed083298004b52f0ba4c234f6cbf

SHA1
56f2447bda2eb634e63d301b265e402a87dbbfdf

SHA256
913476d6b2afe6f789962051d94112aa3349d5e2a5c80217b37b7161b6bf8849

SHA512
704d10b6335aeb0efa365370fa256782c767df5f9fb8482781e7b8b7afc53ce488fb865700ce63a5bc67b0bb878b44c4dce960ef6238d10d3dda366e730de661

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe

Filesize
468KB

MD5
c9407f8e0e9140fa8e0d04541d690b65

SHA1
0b2dd4a06d487df904579a388810c08188a19e5b

SHA256
20b80559292ad8f78a2f4d665b297f87193631533b11305062471a9f7fef608c

SHA512
7aa4a0827426fb172a4955c11cae9d53c5f428f09c3771c202e3f09376390c05631aa048c5efe973f85ebbb157497c2bd0ef280471bbb3b476252e1a9e4566ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe

Filesize
468KB

MD5
7dab55221e292ca433b9c19edca7cf89

SHA1
202e89a6152ceaaeeef96be1cb4270b94c0dac4a

SHA256
99d8c0ac382465e505a54f7fdb50a76cb8f97a47d17be35c6749914374eb263e

SHA512
4b9f09ded28c49e55f5d899dacb228016f1fb7ff4bcafe62d6b7e6c63126acb2de213a0f0e9c02fb52f949bc967ba6fc350c95b55a1e7746a634a5cf296590f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe

Filesize
468KB

MD5
a3f57e0c7025dd083b59fa43beb0e2ea

SHA1
26d0ea0c1f712105261a18435d4ec5102df4efb5

SHA256
638972efdcd15faf77bb50a4044f6af92bf1bdad7cb17c359454e5391ac9ec43

SHA512
43e16d75f46ba13565e6303db1538b442675f680417579bb69b97a14322dced854020c839e14833200a4f5b20690ca0a53da861693933d5a108027b84cc90f7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe

Filesize
468KB

MD5
c5b487b41fda7e4c48bd1999f1c09551

SHA1
8214d1cfb203c3d7043219acae286b2d32114397

SHA256
9e46cbda373fbc085479a71c5278f36edb61d7e66c3bb79a7c1c72281532f49e

SHA512
e0c844bfdda2ad4ddd17f098e3ff696a58fd08147c13903a1a8601f5aebcafb3547a67e9b4aadd1516cb8ba22adf75bb6ddc1630b6220e9b18ba4fb036e68e00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2127.exe

Filesize
468KB

MD5
e49542259f4f42cdca0b66fc0de9864b

SHA1
a6af39a1b608c9bd02023bf371e16c9ba197501f

SHA256
9dd23584954a460036a5d81da7d56e5cc3ade34a823e2aa720e06614b47835a5

SHA512
9137062522310c53811513baa9f258a0fcbb7e54ffca8a90f10b955f86a2d0cc900df13c5fcf40dea3a4edcfa1ac91ff4a5c9c4316bd04a0531de4a97731e243

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23791.exe

Filesize
468KB

MD5
55445e7d9e7fe6bc65f582a207247478

SHA1
2695224d0177a299508b117e4e14c4f3eff60ab6

SHA256
6b2301c2816683b5f6a60f1706a589a78d800dca4e74e81b59ab3ae41855fcd5

SHA512
4f4f4ce45b2e0f45f61ef1ef9760d18927fd3dda2816d00163cf6c023721481c8eff4fcdb68b53ca1abb67c24a4179909c8187845a62fcb72c4ad5336bc16949

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe

Filesize
468KB

MD5
e6908b27707b9a27bc77882945c8156a

SHA1
f6283f835ec78b13f18aeb6547dbc2f30f9afa9d

SHA256
a092af9f7f915a9653cce8d89927b0b162a708c6bc7e231c104d27751f9d1b62

SHA512
fe943d55279153f0db781245883db6ff4df4c021eeb084a7a171a9a31ca1a1779b91e2b7f30e31a4c39b8e0f7f55f0004fb0490829cfa4d630ce825d38990887

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe

Filesize
468KB

MD5
353a5ada04d4dc48347e54bf0fb54a37

SHA1
6c21a2c1f6d59882eb40c8500a290a2a2ad1c8c3

SHA256
c1749dec8d42acfa668b4ffad31614ada187b224a5094db7f97be89ae7fa9ea8

SHA512
68397519f35d70d9c18d7206d047afffdc5b3d7d1402696a27de8a32b4428c6ad2faacca4364d609ab4e98c89e905e6c6f2e5afbb0d1c99e9575681c18f4d5e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe

Filesize
468KB

MD5
487f086028796a39f887c96fae803076

SHA1
5b399d67c3837da48fed5519ceb65b0f560e7138

SHA256
1c6b2269d18b168695466b14720aa34cd4febd1f71d21121d301cdde787794b5

SHA512
5605daaee099c1b3b9b0af62771ab1f581f3de5f3ef861bdc2c87c1e6ae39b50a1c4589c845f3e89aa868a909ecb408ac622f8bdad75daf46ce404f311cd4132

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30860.exe

Filesize
468KB

MD5
098971814fe40b6bad950044717dea3c

SHA1
d162a7e21d522b6d986c780a39d8b0b08e546f06

SHA256
ad2b1fc7e88676a6e0a37399da5fff9d2ff684e00de34c12a46edf918a8c0c7d

SHA512
6329637827516af43bb988f482f1c37540a65f306ed0f66135c647ef0d881ab2f84cd522ee3394786d6ed80300b80a4ab9a0efe6672846686b01f261944220f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32998.exe

Filesize
468KB

MD5
4ca8b227995af9b48cf93c6d6e1e177e

SHA1
c46d9f21ca0c1908435cb5b6feb046f68e6de23d

SHA256
3b8dda6566668c8d7fbbf6f5b3e7d362c1d1ac4ef4510b707fac7842ba430b70

SHA512
be25bae4d999354bf04ec035e100da4d2f6f3ed308f0fa6718e7bbeb0d4f437f119532c322955721298f27168a9cd06ac54954cc7266bef39ba84c0c656e883d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34891.exe

Filesize
468KB

MD5
a6218a038e51cd3a0061fb94c8280fa1

SHA1
6e8fd157ebc49d60c54d965b15c388e373ea3869

SHA256
68bcb5e698ae5a6707f94165fafccd4b8fe62ae19327ca4dd86c2881a9e121ba

SHA512
18f5b4183193fe787bcec02c2ec18c23145bcbb2a420854d7dc7a30cb21d140dada869f7c76eaaadb6e943a163a1e4797b551736c3508543750eb1075ed85cd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35246.exe

Filesize
468KB

MD5
4211f4a827b1d1ae3b316536e9a644c9

SHA1
b8e38f08035b641c7ae7cd7f5c03dba03ce15496

SHA256
b6cb542815f69018d88ca29c30fccf7cf08ede7afd0729914f523051aaa840ee

SHA512
cda46113d7605b9460f1f969f33c9e504d8d7ae25fa43a00c12c0badf877b5b7b721bf069138db4466cf21ab8917b5b143ac6dcba07275b852d5c578f98f4044

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe

Filesize
468KB

MD5
5f9a9da596c33caf92cefc0159d580e9

SHA1
6a4c81037e994a18694918d3059864179eb020e7

SHA256
8e9021b954ab97c5708097eb5168fd911a5cdbcfc3fe6a8f0510bf72f6cf21d1

SHA512
d76e3e08611995448ca558e33cd8720fe48e8d63e8dbef9cf3d6cfa5ea822a3c63d66a5246bf4d8863d8be0590cb4efa9d16d0fb61703cb3806972eeb1edb654

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe

Filesize
468KB

MD5
15a6891da93853ac33ef09b3993757bc

SHA1
38f635bbefc017ab56d4285a49b5400be9d0feec

SHA256
0d23c36a81505a799457781fcfa654112dfba2bfae37ff138595a2c84c23efba

SHA512
2364ca38acc3259c0ceb33b00207c1bce0977a3689330dbaa0452bbdf92cf6520cae5087889cd46dc075b0fb8942089fad3762f3bfbaf50ba1c92f2b7ad82bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41214.exe

Filesize
468KB

MD5
27dc06c7ecd1b7aa16e8544bebb62239

SHA1
0a53d6e1d42861b7e7d7d0b8e0b806f2041d920a

SHA256
791a1825e0196aaea68a89a43148017b93ba8ca31a615f18b3b3eb3ba714972e

SHA512
0901bf6d8e9bad22d7ae9e55cfaf1ed4171bbe955714e2fc725df55a6ec50e5542d77e49780b2a45bc8b615aa0cdb75fbada4fb8f2c747a94078c815add9f4d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41796.exe

Filesize
468KB

MD5
987d4993b642c6068fe4ad2a9b0072a6

SHA1
a630bb022d480d9d7ebe5ce09783234d345ec7d7

SHA256
0d15e96bb531fb91b22bb443c52cc714a8e773a94711ecc20332105a75f4b087

SHA512
ad7f928b6e0ed0966c519dedad00e42453c9d377e75af59da249977f2c351d09f10e86af42ca142e63e230cf6f811ebcad36f3e7764d4741168c2ec5051b4651

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe

Filesize
468KB

MD5
5561e5c4f53b6f33c983de1196327e36

SHA1
86468876783dcd60548c5cb33c0e70449cdc0c95

SHA256
3a13a5ba683d1784e4bf5339a2fc8e067b364b4ab525aa17b46f302d7b2794a4

SHA512
0daa2e88d091371710a48515fcad19da86f949ac2306079760b0850bd210fa407515594218ad2242d3054cf962beb52789673cb13120584f376d021166c739cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe

Filesize
468KB

MD5
e88c85cdd87ad7333c92f239229d8643

SHA1
1402e3a5c85d3ce427960cdb086789d5adbb07b4

SHA256
2f3a193a4575dbca2dda23c3c13e51688c23d003715f8b30d4096a069b3c97d1

SHA512
e9c439fee10e5f4091b410a942f47101a5288b374661fd4326c2d253dc158135862b2a8777cabc5807700d5d3c7deceee90bc6133c973bbeca610894a9b91d54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44696.exe

Filesize
468KB

MD5
9a7da58c6a3db6610ab83cbc4f612b6c

SHA1
961a24b282f45299617313cb7bfc3f12c03bb39e

SHA256
64c77abd5d128e5d9dc4aab172adbf7aa09f60b2ef2d62b2c0fdb58e3184d68c

SHA512
85a147b5115385434069f98dd8b2975a4a6587e202fe9cbbb609da2560ceeb91e3b8e2f37ec3762722122dca0eb8b3d42d937bced1748cb5d4914caea78755ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45386.exe

Filesize
468KB

MD5
2d716ab23e3d22093d22556c11c64430

SHA1
4d42447e6039879fffdcc60876fac46a3ca48bde

SHA256
bcf279400f6df9b3b2605b49972efdfed828b26847006d6f8ba0208937699d60

SHA512
ff4ebfc211d19ba884575e4173ea8895dac76e8ceeeb3e8a914bb96e1843c60019dc81de0b442dd49762886af90054536a70c9c11d00ea85cd290ea98579566a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47005.exe

Filesize
468KB

MD5
3a0c047e8daec7a5f8a66f942080a7c3

SHA1
8bda0f2243a6371557d599c3ee91cf527f64f025

SHA256
814ad80ce147849321a55a7b7c31a7ec6ede11abda3eb340c80ec25f07153580

SHA512
ed7146234f07d5ec9e214ba427e5b7e36cd45a2e31e3f3515242814d3e4fd35f11ff48a0fdf3c7dc4d619254f4787b5062c1696c2ed2cc954b352a8d548ff435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50726.exe

Filesize
468KB

MD5
0cf522d48281dd6e2b7478b3e0ad606b

SHA1
8bc1bfb68b25f76ee5b556fd4e0de108cbb3beef

SHA256
282cd2ae30e546074d0fb9b8112e079d88007b31d634f7e93f7ef6ef61af07e6

SHA512
e5070cf2408accbc3e625e6119731295d898ce11cc572e254b69e2e5cb5664cfcafa4d283c4e43d1d4112fafd20f6348572b0fe44d95610c6998b77cc1b6a35e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51177.exe

Filesize
468KB

MD5
096ae1d769c1de9f5585ca926405523c

SHA1
29d02a3cde9de19c5c3ba8608baed0d7941c24a4

SHA256
720576ea886fa345ef8e4e891fdc21f2c608f1d4e0953ee0af2acb27a0bba39f

SHA512
a7afabf11ba9f8d4967a83ac0e7d25278d0ba12ebfc29d0dec6f192d3ff03a0143706b334d5e5f329265c90ac3e60a6618cf6324c140d61a504ecd36f3319225

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe

Filesize
468KB

MD5
2c874e779fd8739398f29f09d8144e3e

SHA1
b39dea0cab44b7f797b1e82f37239af51ca14dda

SHA256
d9bc3ee62c796ba755811af237aab5ec8cca6278ab6df0ceff164007efb2e958

SHA512
71d696911cb736bec862173ee15f3dbe34c43fa018844ee083d162f7c54fda822ef53307269c7458a23fc1190c899648854134ef946bb3c7f497cc6cde5485d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe

Filesize
468KB

MD5
34af1d6e32c56964279022d46b44dc5b

SHA1
e79e8409523f870c23379073346950e1f5161037

SHA256
81230763cbce751f543c0b71aa5ec80a9923e0f53afdf1992625a82967f22e01

SHA512
0b00a6dd34a22d44e27b3f78418a1817b06c5da7b20282fa7907c49ed7e221299635a35de1c898091aa443d83f2e46e67c13e18d2a409ab05ddf01120af6befe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58702.exe

Filesize
468KB

MD5
30931eb4906f480050ddff66c398cc43

SHA1
2c99c146aa4e0c77e4819a1e5b29f77b755d27f3

SHA256
a09863bd9b8de4284acffd6b890422916954cc26fbb094e8319b62d724d2ce51

SHA512
6ceeb253b2ed944eb148ee9f450e73f15ceb9f8f9318d7350650a027c8268e9229369e2139a75a4f3ee562726bafa169d698f4e8bcd1d7b40fa04b93b89ea04a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63580.exe

Filesize
468KB

MD5
5211c962942cd79406fa94ec0da737f0

SHA1
979b788b26f757cef149e91a914759fbebbf91b8

SHA256
e27c63de81131f68965198b7e893476bd985803c572adfd27468bac410df25c1

SHA512
28ef406809f2178061cc4889dff0b98e7c688b2736943ec5598593058f7efde9dfd67dfceda5d5d8dc8c3bfca5f2bac136715cc46d9dbbd5113ebd26c633e496

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe

Filesize
468KB

MD5
7b7ef4592b3f46523f13c1f1cf5f70ad

SHA1
608e98a747e57737c79acdc9bd72fe1d7e9bf8ef

SHA256
e94da666c517e7db7daef19e93da0b733b156c4daaf9e877c01052e024ae7337

SHA512
e1574293b198bef114f90b7e3d37e908857d2369ecab79341e4209dd0c47cd4a8b4eaeac63e1fde29f1392ae2ba9126b9b8e0f7688b66918d8ab55c4bb506840

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe

Filesize
468KB

MD5
bcacf755a4ca6270bddcb78b7ad74760

SHA1
ce680462bb8e79987b078ada9adefd117507f27f

SHA256
bfbeb9b9d599501a4db1c5b193d32a628de792bf2762fd2ca905b00c4b1663f4

SHA512
594d9e93b0aaeb0a93fb8fe75789a75b173bad88eddc0e6a71d6a7fbc63c24c32abdca2ae4b4fac67a043824a696414354fbf260a12e447944390c3cab409e99

Download Submit
memory/320-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/512-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/548-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/704-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/744-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/872-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/876-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/992-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1108-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1116-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1188-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1220-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1256-2784-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1256-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1360-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1392-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1412-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1456-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1612-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1740-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1816-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1844-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-2785-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2584-3726-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2584-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2716-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3172-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3176-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3296-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3368-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3372-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3424-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3464-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3492-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3532-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3592-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3656-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3720-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3788-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3796-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3888-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3892-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3936-2684-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3936-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3980-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4052-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4072-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4100-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4112-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4184-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4380-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4388-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4456-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4492-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4612-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4676-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4684-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4688-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4724-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4800-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4864-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4868-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4988-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-569-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5192-570-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-571-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-572-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13152-3722-0x00007FFEE7270000-0x00007FFEE72F3000-memory.dmp

Filesize
524KB

Download
memory/14424-2783-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14616-2796-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16108-2813-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16148-2811-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16292-2812-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads