6931419b9c1e43787f764cc3d93bf5b89d50bedab96b259de3cbea098aabfe95

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e3655dce3bf320e307a4a555456f630N.exe
Size

468KB
MD5

7e3655dce3bf320e307a4a555456f630
SHA1

be3572730ac68e95b7811f6ed57932f3b9aa9d5d
SHA256

6931419b9c1e43787f764cc3d93bf5b89d50bedab96b259de3cbea098aabfe95
SHA512

03f3d97e8bda422fb55063e50da2006a1ecee9335570c7a4707a30c5454a54952aaf8270d956e128baa403a8cddf4f57a2feea653709d77b83553cac8a7c8310
SSDEEP

3072:uqoCogLNjY8U2bx2PzqAff5lChjWIpBImHevVw8wY2x3SheNJdlN:uqNo41U2oPeAfff0M7wY2J6eNJ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2388	Unicorn-47292.exe
4140	Unicorn-4287.exe
5092	Unicorn-45875.exe
2600	Unicorn-32632.exe
1372	Unicorn-8682.exe
4136	Unicorn-20380.exe
1712	Unicorn-9781.exe
3872	Unicorn-30432.exe
1768	Unicorn-30432.exe
3572	Unicorn-20217.exe
3084	Unicorn-50395.exe
3988	Unicorn-30794.exe
1560	Unicorn-30794.exe
1364	Unicorn-50660.exe
3968	Unicorn-33098.exe
2016	Unicorn-28460.exe
1784	Unicorn-9938.exe
2456	Unicorn-37588.exe
4364	Unicorn-33504.exe
2744	Unicorn-63938.exe
1488	Unicorn-4531.exe
4844	Unicorn-4531.exe
3612	Unicorn-4531.exe
3916	Unicorn-4531.exe
1112	Unicorn-42034.exe
1512	Unicorn-41215.exe
5056	Unicorn-32549.exe
3976	Unicorn-35350.exe
1380	Unicorn-56576.exe
864	Unicorn-32626.exe
2452	Unicorn-38194.exe
3016	Unicorn-40048.exe
2964	Unicorn-25749.exe
3060	Unicorn-45786.exe
932	Unicorn-53260.exe
980	Unicorn-53623.exe
4912	Unicorn-64936.exe
3552	Unicorn-12398.exe
3244	Unicorn-551.exe
1260	Unicorn-57920.exe
1740	Unicorn-41584.exe
3504	Unicorn-37500.exe
1944	Unicorn-37500.exe
2064	Unicorn-17080.exe
1144	Unicorn-4562.exe
1452	Unicorn-50499.exe
3952	Unicorn-29694.exe
4600	Unicorn-43430.exe
3936	Unicorn-40630.exe
1448	Unicorn-49560.exe
4160	Unicorn-45211.exe
372	Unicorn-25610.exe
2040	Unicorn-15926.exe
4260	Unicorn-13358.exe
1880	Unicorn-13763.exe
436	Unicorn-38076.exe
1984	Unicorn-46607.exe
4452	Unicorn-53955.exe
3548	Unicorn-41968.exe
4616	Unicorn-11333.exe
1656	Unicorn-2014.exe
3628	Unicorn-47951.exe
3344	Unicorn-2279.exe
984	Unicorn-55299.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
888	3976	WerFault.exe	119
6832	5612	WerFault.exe	221
6948	5924	WerFault.exe	226
6912	5972	WerFault.exe	227
6500	5972	WerFault.exe	227
7320	5924	WerFault.exe	226
1240	5544	WerFault.exe	186
6876	5612	WerFault.exe	221
14124	13468	WerFault.exe	648
7864	17564	WerFault.exe	1007

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8331.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17072	dwm.exe
Token: SeChangeNotifyPrivilege	17072	dwm.exe
Token: 33	17072	dwm.exe
Token: SeIncBasePriorityPrivilege	17072	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2248	7e3655dce3bf320e307a4a555456f630N.exe
2388	Unicorn-47292.exe
4140	Unicorn-4287.exe
5092	Unicorn-45875.exe
1372	Unicorn-8682.exe
2600	Unicorn-32632.exe
4136	Unicorn-20380.exe
1712	Unicorn-9781.exe
1768	Unicorn-30432.exe
1560	Unicorn-30794.exe
3988	Unicorn-30794.exe
1364	Unicorn-50660.exe
3872	Unicorn-30432.exe
3572	Unicorn-20217.exe
3084	Unicorn-50395.exe
3968	Unicorn-33098.exe
2016	Unicorn-28460.exe
1784	Unicorn-9938.exe
2456	Unicorn-37588.exe
4364	Unicorn-33504.exe
3612	Unicorn-4531.exe
3916	Unicorn-4531.exe
4844	Unicorn-4531.exe
1112	Unicorn-42034.exe
1488	Unicorn-4531.exe
2744	Unicorn-63938.exe
5056	Unicorn-32549.exe
3976	Unicorn-35350.exe
1512	Unicorn-41215.exe
1380	Unicorn-56576.exe
864	Unicorn-32626.exe
2452	Unicorn-38194.exe
3016	Unicorn-40048.exe
2964	Unicorn-25749.exe
3060	Unicorn-45786.exe
932	Unicorn-53260.exe
980	Unicorn-53623.exe
4912	Unicorn-64936.exe
3552	Unicorn-12398.exe
3244	Unicorn-551.exe
1260	Unicorn-57920.exe
1740	Unicorn-41584.exe
2064	Unicorn-17080.exe
1144	Unicorn-4562.exe
1944	Unicorn-37500.exe
3504	Unicorn-37500.exe
2040	Unicorn-15926.exe
4600	Unicorn-43430.exe
372	Unicorn-25610.exe
1452	Unicorn-50499.exe
1448	Unicorn-49560.exe
4160	Unicorn-45211.exe
3952	Unicorn-29694.exe
3936	Unicorn-40630.exe
4260	Unicorn-13358.exe
1880	Unicorn-13763.exe
436	Unicorn-38076.exe
1984	Unicorn-46607.exe
4452	Unicorn-53955.exe
1656	Unicorn-2014.exe
3628	Unicorn-47951.exe
3548	Unicorn-41968.exe
784	Unicorn-47759.exe
984	Unicorn-55299.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2388	2248	7e3655dce3bf320e307a4a555456f630N.exe	87
PID 2248 wrote to memory of 2388	2248	7e3655dce3bf320e307a4a555456f630N.exe	87
PID 2248 wrote to memory of 2388	2248	7e3655dce3bf320e307a4a555456f630N.exe	87
PID 2388 wrote to memory of 4140	2388	Unicorn-47292.exe	88
PID 2388 wrote to memory of 4140	2388	Unicorn-47292.exe	88
PID 2388 wrote to memory of 4140	2388	Unicorn-47292.exe	88
PID 2248 wrote to memory of 5092	2248	7e3655dce3bf320e307a4a555456f630N.exe	89
PID 2248 wrote to memory of 5092	2248	7e3655dce3bf320e307a4a555456f630N.exe	89
PID 2248 wrote to memory of 5092	2248	7e3655dce3bf320e307a4a555456f630N.exe	89
PID 4140 wrote to memory of 2600	4140	Unicorn-4287.exe	90
PID 4140 wrote to memory of 2600	4140	Unicorn-4287.exe	90
PID 4140 wrote to memory of 2600	4140	Unicorn-4287.exe	90
PID 2388 wrote to memory of 1372	2388	Unicorn-47292.exe	91
PID 2388 wrote to memory of 1372	2388	Unicorn-47292.exe	91
PID 2388 wrote to memory of 1372	2388	Unicorn-47292.exe	91
PID 5092 wrote to memory of 4136	5092	Unicorn-45875.exe	92
PID 5092 wrote to memory of 4136	5092	Unicorn-45875.exe	92
PID 5092 wrote to memory of 4136	5092	Unicorn-45875.exe	92
PID 2248 wrote to memory of 1712	2248	7e3655dce3bf320e307a4a555456f630N.exe	93
PID 2248 wrote to memory of 1712	2248	7e3655dce3bf320e307a4a555456f630N.exe	93
PID 2248 wrote to memory of 1712	2248	7e3655dce3bf320e307a4a555456f630N.exe	93
PID 1372 wrote to memory of 3872	1372	Unicorn-8682.exe	98
PID 1372 wrote to memory of 3872	1372	Unicorn-8682.exe	98
PID 1372 wrote to memory of 3872	1372	Unicorn-8682.exe	98
PID 2600 wrote to memory of 1768	2600	Unicorn-32632.exe	99
PID 2600 wrote to memory of 1768	2600	Unicorn-32632.exe	99
PID 2600 wrote to memory of 1768	2600	Unicorn-32632.exe	99
PID 2388 wrote to memory of 3572	2388	Unicorn-47292.exe	100
PID 2388 wrote to memory of 3572	2388	Unicorn-47292.exe	100
PID 2388 wrote to memory of 3572	2388	Unicorn-47292.exe	100
PID 2248 wrote to memory of 3084	2248	7e3655dce3bf320e307a4a555456f630N.exe	101
PID 2248 wrote to memory of 3084	2248	7e3655dce3bf320e307a4a555456f630N.exe	101
PID 2248 wrote to memory of 3084	2248	7e3655dce3bf320e307a4a555456f630N.exe	101
PID 4140 wrote to memory of 3988	4140	Unicorn-4287.exe	102
PID 4140 wrote to memory of 3988	4140	Unicorn-4287.exe	102
PID 4140 wrote to memory of 3988	4140	Unicorn-4287.exe	102
PID 5092 wrote to memory of 1560	5092	Unicorn-45875.exe	103
PID 5092 wrote to memory of 1560	5092	Unicorn-45875.exe	103
PID 5092 wrote to memory of 1560	5092	Unicorn-45875.exe	103
PID 4136 wrote to memory of 1364	4136	Unicorn-20380.exe	104
PID 4136 wrote to memory of 1364	4136	Unicorn-20380.exe	104
PID 4136 wrote to memory of 1364	4136	Unicorn-20380.exe	104
PID 1712 wrote to memory of 3968	1712	Unicorn-9781.exe	106
PID 1712 wrote to memory of 3968	1712	Unicorn-9781.exe	106
PID 1712 wrote to memory of 3968	1712	Unicorn-9781.exe	106
PID 1768 wrote to memory of 2016	1768	Unicorn-30432.exe	107
PID 1768 wrote to memory of 2016	1768	Unicorn-30432.exe	107
PID 1768 wrote to memory of 2016	1768	Unicorn-30432.exe	107
PID 2600 wrote to memory of 1784	2600	Unicorn-32632.exe	108
PID 2600 wrote to memory of 1784	2600	Unicorn-32632.exe	108
PID 2600 wrote to memory of 1784	2600	Unicorn-32632.exe	108
PID 1560 wrote to memory of 2456	1560	Unicorn-30794.exe	109
PID 1560 wrote to memory of 2456	1560	Unicorn-30794.exe	109
PID 1560 wrote to memory of 2456	1560	Unicorn-30794.exe	109
PID 1364 wrote to memory of 4364	1364	Unicorn-50660.exe	110
PID 1364 wrote to memory of 4364	1364	Unicorn-50660.exe	110
PID 1364 wrote to memory of 4364	1364	Unicorn-50660.exe	110
PID 5092 wrote to memory of 2744	5092	Unicorn-45875.exe	111
PID 5092 wrote to memory of 2744	5092	Unicorn-45875.exe	111
PID 5092 wrote to memory of 2744	5092	Unicorn-45875.exe	111
PID 3572 wrote to memory of 4844	3572	Unicorn-20217.exe	113
PID 3572 wrote to memory of 4844	3572	Unicorn-20217.exe	113
PID 3572 wrote to memory of 4844	3572	Unicorn-20217.exe	113
PID 3988 wrote to memory of 3612	3988	Unicorn-30794.exe	114

C:\Users\Admin\AppData\Local\Temp\7e3655dce3bf320e307a4a555456f630N.exe
"C:\Users\Admin\AppData\Local\Temp\7e3655dce3bf320e307a4a555456f630N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47292.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47292.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4287.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28460.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        7⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        8⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8255.exe
        9⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11706.exe
        9⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
        8⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        8⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34642.exe
        8⤵
        
        PID:17164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        8⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exe
        8⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54127.exe
        8⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37259.exe
        7⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43358.exe
        7⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34443.exe
        7⤵
        
        PID:17852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11333.exe
        6⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23454.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        8⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26476.exe
        9⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33512.exe
        9⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        9⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
        8⤵
        
        PID:11492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        8⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32685.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        7⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17922.exe
        7⤵
        
        PID:14916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50455.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        8⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        8⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
        7⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        7⤵
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
        7⤵
        
        PID:17948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62838.exe
        6⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        6⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10619.exe
        6⤵
        
        PID:15324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47523.exe
        6⤵
        
        PID:19288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9938.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26216.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        9⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47332.exe
        10⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe
        10⤵
        
        PID:18484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        9⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        9⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3336.exe
        9⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60263.exe
        9⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        8⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40906.exe
        8⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        8⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9035.exe
        8⤵
        
        PID:724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60787.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3491.exe
        8⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39614.exe
        8⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        8⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4579.exe
        8⤵
        
        PID:18500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27643.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        7⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37131.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47951.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17856.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        8⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        9⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        9⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
        9⤵
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27798.exe
        8⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11217.exe
        8⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23272.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6107.exe
        8⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56764.exe
        8⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56859.exe
        7⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24938.exe
        7⤵
        
        PID:16336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2161.exe
        6⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        7⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15737.exe
        7⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        7⤵
        
        PID:17896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12595.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63390.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17536.exe
        6⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        6⤵
        
        PID:19280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        6⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe
        8⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15737.exe
        8⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15679.exe
        8⤵
        
        PID:17268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30713.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        7⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        7⤵
        
        PID:16544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5773.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        7⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3336.exe
        7⤵
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63579.exe
        7⤵
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55375.exe
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57.exe
        6⤵
        
        PID:13912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18810.exe
        7⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        7⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        7⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
        6⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54923.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34405.exe
        6⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
        6⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7383.exe
        7⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
        7⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exe
        7⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3391.exe
        7⤵
        
        PID:18656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45094.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        6⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
        6⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55064.exe
        7⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6460.exe
        7⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        6⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5730.exe
        6⤵
        
        PID:17312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52953.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
        5⤵
        
        PID:16556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30794.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4531.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        7⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 632
        8⤵
        Program crash
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50751.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        8⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        8⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52023.exe
        7⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56124.exe
        7⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        7⤵
        
        PID:17600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18602.exe
        6⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61696.exe
        8⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        8⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52251.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        7⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15643.exe
        7⤵
        
        PID:18468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27641.exe
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5478.exe
        6⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        6⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        8⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        8⤵
        
        PID:16616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35670.exe
        7⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        7⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exe
        7⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23314.exe
        6⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10295.exe
        7⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56859.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7499.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
        6⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        6⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3336.exe
        6⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe
        6⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
        5⤵
        
        PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        5⤵
        
        PID:11704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39262.exe
        5⤵
        
        PID:18680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3976
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 724
        5⤵
        Program crash
        
        PID:888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36704.exe
        7⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
        7⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35774.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2857.exe
        6⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61451.exe
        6⤵
        
        PID:17860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64347.exe
        5⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30908.exe
        6⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27791.exe
        6⤵
        
        PID:17500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        5⤵
        
        PID:11804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        5⤵
        
        PID:16360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41790.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        5⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58876.exe
        6⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48027.exe
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55950.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4579.exe
        5⤵
        
        PID:16508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42218.exe
      4⤵
      PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51224.exe
        5⤵
        
        PID:12572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20199.exe
        5⤵
        
        PID:16896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4427.exe
      4⤵
      PID:10436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63390.exe
      4⤵
      PID:14888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5284.exe
      4⤵
      PID:16316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
      4⤵
      PID:19232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4531.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11215.exe
        7⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63024.exe
        9⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41416.exe
        10⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7918.exe
        10⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        10⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53552.exe
        10⤵
        
        PID:18800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        9⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        9⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47392.exe
        9⤵
        
        PID:17540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49163.exe
        8⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe
        8⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
        8⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62128.exe
        8⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        7⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34585.exe
        9⤵
        
        PID:18672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58924.exe
        8⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
        8⤵
        
        PID:18848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32495.exe
        7⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41850.exe
        7⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50741.exe
        7⤵
        
        PID:16580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        8⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        8⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        8⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49178.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        7⤵
        
        PID:16624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5773.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        7⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        7⤵
        
        PID:16512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55375.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33675.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        6⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35078.exe
        7⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60035.exe
        8⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        8⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
        8⤵
        
        PID:16676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24177.exe
        7⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45927.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
        6⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        7⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
        8⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15731.exe
        8⤵
        
        PID:16856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45856.exe
        7⤵
        
        PID:15732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
        6⤵
        
        PID:12416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34258.exe
        6⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47923.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56124.exe
        6⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13743.exe
        6⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        5⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10139.exe
        6⤵
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59361.exe
        6⤵
        
        PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
        5⤵
        
        PID:11236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26822.exe
        5⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35173.exe
        5⤵
        
        PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2279.exe
        5⤵
        Executes dropped EXE
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53071.exe
        8⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        8⤵
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        7⤵
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39650.exe
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6697.exe
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27519.exe
        6⤵
        
        PID:15384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        6⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        5⤵
        
        PID:5972
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 264
        6⤵
        Program crash
        
        PID:6912
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 256
        6⤵
        Program crash
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27641.exe
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1202.exe
        5⤵
        
        PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55299.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56636.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        7⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
        7⤵
        
        PID:17780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58395.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
        6⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58876.exe
        6⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe
        5⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        6⤵
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        6⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        5⤵
        
        PID:10960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6793.exe
        5⤵
        
        PID:15328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        5⤵
        
        PID:17016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10269.exe
      4⤵
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23772.exe
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        6⤵
        
        PID:440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        6⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15103.exe
        6⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe
        5⤵
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26977.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58876.exe
        5⤵
        
        PID:16648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
      4⤵
      PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
        5⤵
        
        PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15022.exe
        5⤵
        
        PID:12504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8086.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41656.exe
      4⤵
      PID:9596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26529.exe
      4⤵
      PID:13468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13468 -s 248
        5⤵
        Program crash
        
        PID:14124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17536.exe
      4⤵
      PID:14968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51723.exe
      4⤵
      PID:19312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20217.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4531.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41584.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
        6⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        7⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44524.exe
        8⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33492.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
        9⤵
        
        PID:17036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        8⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        8⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe
        8⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        7⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
        7⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        6⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        7⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        7⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
        7⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52784.exe
        7⤵
        
        PID:18036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
        6⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34405.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36850.exe
        5⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
        6⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
        7⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        7⤵
        
        PID:17808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59598.exe
        6⤵
        
        PID:10532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27519.exe
        6⤵
        
        PID:15376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47956.exe
        6⤵
        
        PID:13608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        6⤵
        
        PID:19032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        5⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
        6⤵
        
        PID:15732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62101.exe
        6⤵
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63935.exe
        6⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        5⤵
        
        PID:10716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        5⤵
        
        PID:15488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
        5⤵
        
        PID:17876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29694.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12235.exe
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
        6⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12879.exe
        7⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        7⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56859.exe
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        6⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        6⤵
        
        PID:18708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64347.exe
        5⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        5⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32337.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        5⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
        5⤵
        
        PID:11500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13567.exe
        5⤵
        
        PID:15776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
      4⤵
      PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
      4⤵
      PID:11520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exe
      4⤵
      PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37500.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
        6⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        7⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        7⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7378.exe
        6⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        6⤵
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15103.exe
        6⤵
        
        PID:16832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18270.exe
        5⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63476.exe
        6⤵
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40235.exe
        6⤵
        
        PID:16696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
        5⤵
        
        PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
      4⤵
      PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4119.exe
        5⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        6⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        6⤵
        
        PID:16668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
        5⤵
        
        PID:10968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        5⤵
        
        PID:15348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19458.exe
        5⤵
        
        PID:17796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
      4⤵
      PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
      4⤵
      PID:10052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43358.exe
      4⤵
      PID:14604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
      4⤵
      PID:16304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19960.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12287.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53564.exe
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59563.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        6⤵
        
        PID:18168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        5⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
        5⤵
        
        PID:17356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59392.exe
        5⤵
        
        PID:12540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22939.exe
        5⤵
        
        PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
      4⤵
      PID:10124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61688.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
    3⤵
    PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
      4⤵
      PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        5⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6802.exe
      4⤵
      PID:10320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
      4⤵
      PID:14532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15103.exe
      4⤵
      PID:216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
    3⤵
    PID:8044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48433.exe
    3⤵
    PID:10408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58054.exe
    3⤵
    PID:14684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
    3⤵
    PID:15096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43552.exe
    3⤵
    PID:7436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64936.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5655.exe
        9⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61888.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50516.exe
        10⤵
        
        PID:17692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        9⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe
        9⤵
        
        PID:17420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49547.exe
        8⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42672.exe
        9⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe
        9⤵
        
        PID:17384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
        8⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        8⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        8⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26623.exe
        8⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4762.exe
        7⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        8⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
        8⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        8⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30864.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        7⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24177.exe
        7⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
        7⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24214.exe
        6⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        8⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        9⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        9⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65515.exe
        8⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        8⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30480.exe
        8⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
        7⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        8⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        8⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        8⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe
        7⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
        7⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        7⤵
        
        PID:17204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18497.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        7⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47740.exe
        7⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
        6⤵
        
        PID:14956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6535.exe
        6⤵
        
        PID:15052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47715.exe
        6⤵
        
        PID:19300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12398.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        6⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38468.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9547.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        9⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41104.exe
        9⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43027.exe
        9⤵
        
        PID:19068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        8⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        8⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59644.exe
        8⤵
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61415.exe
        7⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        7⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3336.exe
        7⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        7⤵
        
        PID:17608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45463.exe
        6⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        7⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51587.exe
        7⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56467.exe
        7⤵
        
        PID:17284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe
        6⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58956.exe
        7⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        7⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40122.exe
        6⤵
        
        PID:13820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        6⤵
        
        PID:14388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21613.exe
        5⤵
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43896.exe
        6⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35758.exe
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51224.exe
        8⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
        8⤵
        
        PID:16720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41386.exe
        7⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54480.exe
        7⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2894.exe
        6⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64540.exe
        7⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28943.exe
        7⤵
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36455.exe
        6⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47956.exe
        6⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61984.exe
        6⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        6⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
        5⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55064.exe
        6⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38699.exe
        6⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
        5⤵
        
        PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42034.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37500.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe
        6⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        8⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        8⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        8⤵
        
        PID:18152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7378.exe
        7⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
        7⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23506.exe
        6⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31292.exe
        7⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27791.exe
        7⤵
        
        PID:17572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        6⤵
        
        PID:14860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        5⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        7⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        7⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35774.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2857.exe
        6⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58876.exe
        6⤵
        
        PID:16608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
        6⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
        6⤵
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        5⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        5⤵
        
        PID:15504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22191.exe
        5⤵
        
        PID:18316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43430.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36932.exe
        5⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12842.exe
        6⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
        7⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        7⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58876.exe
        7⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61762.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8722.exe
        6⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        6⤵
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        6⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22562.exe
        6⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33742.exe
        6⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17082.exe
        5⤵
        
        PID:13084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        5⤵
        
        PID:16308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        5⤵
        
        PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
      4⤵
      PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        6⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4579.exe
        6⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        5⤵
        
        PID:13768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58379.exe
        5⤵
        
        PID:16660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
      4⤵
      PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62500.exe
        5⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
        5⤵
        
        PID:16688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22198.exe
      4⤵
      PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8947.exe
      4⤵
      PID:12968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41462.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30794.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37588.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18808.exe
        6⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        8⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
        9⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
        9⤵
        
        PID:17784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        8⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47939.exe
        8⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        8⤵
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64347.exe
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        8⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        8⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        8⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21113.exe
        7⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17082.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41132.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        6⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 264
        7⤵
        Program crash
        
        PID:6948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 288
        7⤵
        Program crash
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27643.exe
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        6⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        6⤵
        
        PID:16540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50144.exe
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26268.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42236.exe
        8⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17564 -s 436
        9⤵
        Program crash
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
        7⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38950.exe
        7⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61451.exe
        7⤵
        
        PID:16596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49163.exe
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        6⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
        5⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        6⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        5⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6451.exe
        5⤵
        
        PID:12944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
        5⤵
        
        PID:16824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53623.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30484.exe
        5⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
        7⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5479.exe
        8⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
        8⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        7⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
        7⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60263.exe
        7⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41378.exe
        6⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35863.exe
        6⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1970.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4762.exe
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18810.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
        6⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32495.exe
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5921.exe
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
        5⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62454.exe
      4⤵
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        5⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19880.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26476.exe
        7⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62101.exe
        7⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44859.exe
        7⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57347.exe
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
        6⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39800.exe
        6⤵
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2318.exe
        5⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7918.exe
        6⤵
        
        PID:15368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exe
        6⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56859.exe
        5⤵
        
        PID:10328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        5⤵
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
      4⤵
      PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
        5⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56380.exe
        6⤵
        
        PID:17816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        5⤵
        
        PID:11348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        5⤵
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29693.exe
      4⤵
      PID:8284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
      4⤵
      PID:12408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
      4⤵
      PID:3568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6747.exe
        5⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30908.exe
        8⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        8⤵
        
        PID:18052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15737.exe
        7⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30480.exe
        7⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19437.exe
        6⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        6⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37294.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        6⤵
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        6⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        6⤵
        
        PID:16480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5729.exe
        5⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45927.exe
        5⤵
        
        PID:16456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
      4⤵
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39842.exe
        5⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        5⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36455.exe
        5⤵
        
        PID:15900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        5⤵
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        5⤵
        
        PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
      4⤵
      PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        5⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
        6⤵
        
        PID:16368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        6⤵
        
        PID:19260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        5⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
        5⤵
        
        PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37259.exe
      4⤵
      PID:10080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43358.exe
      4⤵
      PID:14476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
      4⤵
      PID:14796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60793.exe
      4⤵
      PID:2932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4562.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64884.exe
      4⤵
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59220.exe
        5⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15551.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        6⤵
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        6⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        6⤵
        
        PID:16500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
        5⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49178.exe
        5⤵
        
        PID:12468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8255.exe
        5⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exe
        5⤵
        
        PID:12952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        5⤵
        
        PID:16564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48586.exe
      4⤵
      PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65323.exe
      4⤵
      PID:13836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
      4⤵
      PID:5900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39426.exe
    3⤵
    PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
      4⤵
      PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57752.exe
        5⤵
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7918.exe
        5⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exe
        5⤵
        
        PID:16280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
      4⤵
      PID:10624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44815.exe
      4⤵
      PID:15768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
      4⤵
      PID:15384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
      4⤵
      PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58747.exe
    3⤵
    PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
      4⤵
      PID:15720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
      4⤵
      PID:10804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27842.exe
      4⤵
      PID:19324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
    3⤵
    PID:10000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
    3⤵
    PID:14416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exe
    3⤵
    PID:17192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32582.exe
        6⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54872.exe
        8⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7179.exe
        8⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51675.exe
        7⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17700.exe
        7⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40855.exe
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5087.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        5⤵
        
        PID:5612
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5612 -s 264
        6⤵
        Program crash
        
        PID:6832
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5612 -s 264
        6⤵
        Program crash
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19473.exe
        5⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28168.exe
        6⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
        6⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63063.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        5⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
        5⤵
        
        PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46607.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41016.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
        7⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        7⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        7⤵
        
        PID:16976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59598.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27519.exe
        6⤵
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        6⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
        5⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exe
        6⤵
        
        PID:16884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        5⤵
        
        PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32900.exe
        5⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57456.exe
        6⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        6⤵
        
        PID:12308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        6⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        5⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5966.exe
      4⤵
      PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        5⤵
        
        PID:16996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3897.exe
      4⤵
      PID:10388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2318.exe
      4⤵
      PID:14616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39257.exe
      4⤵
      PID:17520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        6⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17348.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        6⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10443.exe
        6⤵
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17414.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        5⤵
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36054.exe
        5⤵
        
        PID:7332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21481.exe
      4⤵
      PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
        5⤵
        
        PID:12464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48212.exe
        5⤵
        
        PID:17864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21882.exe
      4⤵
      PID:10764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
      4⤵
      PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
      4⤵
      PID:15228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exe
      4⤵
      PID:13620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53955.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62396.exe
      4⤵
      PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
        5⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        6⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        6⤵
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38840.exe
        6⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14674.exe
        5⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
        6⤵
        
        PID:16812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        5⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
        5⤵
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
      4⤵
      PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
        5⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15531.exe
        6⤵
        
        PID:15440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        6⤵
        
        PID:17460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10746.exe
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        5⤵
        
        PID:14668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exe
      4⤵
      PID:9852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65323.exe
      4⤵
      PID:13860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
      4⤵
      PID:5396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6185.exe
    3⤵
    PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
      4⤵
      PID:8784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
      4⤵
      PID:11564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exe
      4⤵
      PID:15132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34452.exe
      4⤵
      PID:14420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
      4⤵
      PID:16744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17167.exe
    3⤵
    PID:10544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8982.exe
    3⤵
    PID:6180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50395.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50395.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4531.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17080.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19688.exe
        6⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19932.exe
        7⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10746.exe
        7⤵
        
        PID:12624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52383.exe
        7⤵
        
        PID:17116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        6⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        6⤵
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30288.exe
        6⤵
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5442.exe
        5⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe
        6⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63647.exe
        6⤵
        
        PID:13016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        6⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7361.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56771.exe
        5⤵
        
        PID:14184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
        5⤵
        
        PID:16764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe
      4⤵
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        5⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44524.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15737.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        6⤵
        
        PID:18132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26595.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29605.exe
        5⤵
        
        PID:14368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39588.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33165.exe
        5⤵
        
        PID:18840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exe
      4⤵
      PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33144.exe
        5⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28640.exe
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40235.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55479.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        5⤵
        
        PID:17480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
      4⤵
      PID:10068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8417.exe
      4⤵
      PID:13324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55440.exe
      4⤵
      PID:16868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21556.exe
      4⤵
      PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35.exe
        5⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51587.exe
        6⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15050.exe
        6⤵
        
        PID:16780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        5⤵
        
        PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        5⤵
        
        PID:14200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        5⤵
        
        PID:17832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
      4⤵
      PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        5⤵
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22939.exe
        5⤵
        
        PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19142.exe
      4⤵
      PID:12008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
      4⤵
      PID:14936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15331.exe
      4⤵
      PID:18160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
    3⤵
    PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10139.exe
        5⤵
        
        PID:12644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15923.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29910.exe
      4⤵
      PID:11164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42074.exe
      4⤵
      PID:14432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61451.exe
      4⤵
      PID:18312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
    3⤵
    PID:7868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
    3⤵
    PID:10956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
    3⤵
    PID:15976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60738.exe
    3⤵
    PID:13472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6206.exe
    3⤵
    PID:5648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32549.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32549.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52064.exe
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52936.exe
        5⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51587.exe
        6⤵
        
        PID:12932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52383.exe
        6⤵
        
        PID:16984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51187.exe
        5⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59458.exe
        5⤵
        
        PID:13848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
        5⤵
        
        PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2318.exe
      4⤵
      PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        5⤵
        
        PID:14548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        5⤵
        
        PID:15376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
      4⤵
      PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
      4⤵
      PID:15512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50979.exe
      4⤵
      PID:17052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
    3⤵
    PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
      4⤵
      PID:8776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
      4⤵
      PID:11580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
      4⤵
      PID:15868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
      4⤵
      PID:5936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34275.exe
    3⤵
    PID:3480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
    3⤵
    PID:12400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17723.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15926.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15926.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
      4⤵
      PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24400.exe
        5⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52355.exe
        5⤵
        
        PID:12972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7894.exe
        5⤵
        
        PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65515.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
      4⤵
      PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
      4⤵
      PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
    3⤵
    PID:8172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
      4⤵
      PID:14896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
      4⤵
      PID:16340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47687.exe
      4⤵
      PID:18832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe
    3⤵
    PID:10660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
    3⤵
    PID:15532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
    3⤵
    PID:17884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
  2⤵
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
    3⤵
    PID:8732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27119.exe
    3⤵
    PID:12248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
    3⤵
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28351.exe
    3⤵
    PID:18768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
  2⤵
  PID:7796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
    3⤵
    PID:14276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15923.exe
    3⤵
    PID:16400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
  2⤵
  PID:11188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
  2⤵
  PID:15820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
  2⤵
  PID:15580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
  2⤵
  PID:19016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3976 -ip 3976
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5612 -ip 5612
1⤵
PID:6172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5972 -ip 5972
1⤵
PID:6392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5924 -ip 5924
1⤵
PID:6488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5972 -ip 5972
1⤵
PID:6464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5544 -ip 5544
1⤵
PID:6708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5612 -ip 5612
1⤵
PID:6552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5924 -ip 5924
1⤵
PID:6348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5516 -ip 5516
1⤵
PID:7384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 13468 -ip 13468
1⤵
PID:13688

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 17564 -ip 17564
1⤵
PID:18048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-20217.exe

Filesize
468KB

MD5
9479d16c78197bdcf0a00eb6cfca0e1f

SHA1
b2fe676ddfa81c8c3173f33f95493ffe8738d535

SHA256
1bea2867796818f6dab7dfd138e544ee6fdf221555edba8413909b8a93ed2b25

SHA512
1ddf2d3c1ad990993df40aca51c3a34c442faa9bd224fc461d123dc4ac33d12ac84a1479b198f70c2e99d5a17fc24967ea935af7d976af2941dbbf8ba807bddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe

Filesize
468KB

MD5
fc05970fe8f9affd47b835355c4ecd69

SHA1
1ba49440c6d44e71994321f4d9fed3cf6bff2f15

SHA256
27d9414c38eb6f32f442f88c3e2462520aa32e977f7dd876d9a41c35222791c9

SHA512
9a3c930016c5e48ef998026ac24ff40f5cba0556231893ebc9fa8016e262f1da5137e914369710719dba0f81ced78428f239b34e9fb2143691f31597b96f2f7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe

Filesize
468KB

MD5
9d66c39387c2d02b81a9988deb0c2b60

SHA1
98fd5258f247d9fd32fd5338b75ccafe4ffd428b

SHA256
d4fb44703f748e74db155ecd440f1ce41be2e2e0118f5f3d0f1c7f5ebae14425

SHA512
b57f658ed04ba51b7917c0f3e138f4413e6544a563432b121556d52a177f99f5472ae2fa82f1e6f3bcfca1568869588cb6a9ed5eb6cb7396e6d62b43228e7ec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28460.exe

Filesize
468KB

MD5
a1ec5655ed08d0aa69b660469c5a6ce1

SHA1
a0a06841ed7727581b3e1426571bba731bdd776a

SHA256
bb73be3676664186777d0a68d1599071ea1bb5f2df25f66d444193aaca726ddd

SHA512
dbb52151dfe20fe352f7af81126580e43869690d4fc5767b7d6abe5fed32065ef10e6351abf5942d6b7c01213af815caefb61c067a81a32a26ccbba49904b3b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe

Filesize
468KB

MD5
41fdd2543f09099b630acd41849ab519

SHA1
32f62f51bb3f67f1c80639ef7d3929c55f01fddf

SHA256
87ec512e374f0e51409a957e2b67a44e8cdd70f72e7d840a4b94fdbc7bf259c0

SHA512
17d0589cc9b1426e56b74447f15dbc0e78bacc7ee601e6d7e9b6f3b6f424c70e3dfe969ca18f4c823865a0c886fccb12911f25f0fa418f0c69c291b02204d53a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30794.exe

Filesize
468KB

MD5
4a3466fb20a5f9fc7ae4fec9bce9d68e

SHA1
d5a515d182ac94985b1633eaca69b7cf82ff4d0a

SHA256
c6e9d4c19d95a7c31d501967b39d62976453ccc1285e82d97cac0b8007f6b221

SHA512
5a30400939f5dc7bc61810dd64a313ed28a92a9d9dc003b198b64340160d855720ed15d5469d2d411314c77fc86c37cd5f8d966a7e7d243fba3ac97854ec9043

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32549.exe

Filesize
468KB

MD5
643d40499b89adb78d531c19720a9f65

SHA1
d8439228c44ed26aaa8fedc51c769c674fff559d

SHA256
a6498ce7453385a4dd026eb4c29f43cd9f5f2bb16186600d43b6baedcb71f262

SHA512
d2366186183fe6812e0a04bf55e9150e8098aa5cdb0f0f8cf7131bdc63619b3e25da5c460d564cf49e5ff4a31a970df6ba49b62991182a368b266b177925258b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe

Filesize
468KB

MD5
ac7c6e9e5aacd69f7c2bdcde98633cb8

SHA1
58f61a19f0184b9ef4833d2796a5fdceea89664f

SHA256
8781f38ba412fc5e051105c82da9bb07236f44521e22084726ed390d7c0c3724

SHA512
a842eeb5d40342b176d292eb336752ea82a524c496abe12c9bbd7b9ba4e7eccc186218d3f47ffa6f1a80539e8e9410bc125f141afa9788532db7203b13cba519

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe

Filesize
468KB

MD5
c91db83df9f3e69cc225e1b1b281e92e

SHA1
258e0068bdb2b687a9198c737a80394530356d23

SHA256
cf774c1349691dcf267e9b4d5c71bc724caf7c174376f46df3604ab236aa8d27

SHA512
f62a5696f578a8f057bdca4563a5fcb44f8976f135bfbf0bf2bc5dece3e90647a24887ce1bd03924b9601c2240b86df850276427f50349f8f13a31b9915d8a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe

Filesize
468KB

MD5
52eb331265959f4af5f2201d8e67de07

SHA1
f9126d183489196d9280343620b0a595d2ec1d43

SHA256
4d9434dd410507a5a9ee962b482edc6811f606d1156194f5dbfc66a5967644f1

SHA512
dcc653b04e228a2c5033287ecde28c8810952f1580550c22d45bb446f4c5a8fd78f0d420194fcd6cf22481c7e5b3c2b6dac4fe9fc65270f9b1bdfc9249b9a8b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe

Filesize
468KB

MD5
cd47711cf75b94da70d6943e99053097

SHA1
0ac924776159ad662ec621ba2197095744bb179a

SHA256
aadefd31f0c9c3ab248bc31307c242bbc92154ddfa1eccc3750e3801ebad4dcc

SHA512
2be4058e98c159bf3cb12f5b5aefa56990e17abb7496ac1b88df366bf44b94ce4cb20f24ebd93c7f425fae8ddec2f452660aa463793cfa1f23a4f35dc75de6f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe

Filesize
468KB

MD5
0893121e57dfcaa1292cadc38855bca4

SHA1
0b880be8b313d8065a0ed09ce3ee0d5c9e15f49d

SHA256
f6ad7f1aabac71cb11ff643509b3a835278e70291e66fc4d0be439189dae4a01

SHA512
93cee8c0e0d8ada594def0012aa88a09fc6bf6d11a55ce17221c32bd663604d6af3a89d38876e5752be7fc6391ead4fda1f365318f60b408636163597c45d761

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37588.exe

Filesize
468KB

MD5
a82d3d47adf8e45376c63286ee840d97

SHA1
37ffa271aee9114f837c26d386fdff670893b71f

SHA256
75f98c490b9ef628963e0b55fe4157582aa9e6e28d5712072a6bfadad0ec8bc0

SHA512
cb9ef561ac4eeecf6ad10487b21c1807cde6290eb70833483736def34e8f70f3317e85dccc826883c3e99552b19f8592ea5a333089ba3c86a5595217e0691832

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe

Filesize
468KB

MD5
67bb00b030f657655180b0a3770ffc4d

SHA1
849ba954f99c65081a5352f4f2783fefcecb2433

SHA256
da088a621fc1e0946ff2c63fb98078f6f85a04e3c8c49e7c6cdce309cf699691

SHA512
355f240a439ab4a19afd865419e8a08a20bc1f6e129447764d88d67b52590a4d4e11129eb3bca4bad4f90c3ffe771c981a87486e96d2f9bdee5da642db919fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe

Filesize
468KB

MD5
3e2feeda56053b84013ad62b3f853e10

SHA1
86e9e0958358c5a7f565580dafdd069eae908b64

SHA256
703eaaff685c24bc36db8055a80ba4c3dca9bbe513b79de67f279154572f845d

SHA512
7f1bd336ac92f23fae40f48e7b9ba0381dd514a4f75bce719353cbbcdb49aea1ad96ceb45a94ab5c6f3ac0927019cc53479d1b3abedb8a9a0ace807777b43458

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe

Filesize
468KB

MD5
8cca75b45f805b7d4af98b4404601c98

SHA1
73e3271299849b1e7bd2c314c8aafec6ecef96f5

SHA256
2f05573eda9e2bcbfa2475324fd21e14a3b8e2a0a545893c789fac69caaa7ca3

SHA512
d09bf93770d686058f994f4423378f9a15435557961efcc48918997acf75bc11cd31b025b371ae80654da2181148636c7df45fe28a6c7d1185abf2c4b4b71265

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42034.exe

Filesize
468KB

MD5
8f547f318d92ccbe9626cdd87b009bc4

SHA1
78d72c5612904b2238272282b6e9c3bc88d95219

SHA256
c0aa9b77a97f73586c11f609e85b51a5f9b55f9b839559caab6d32640cb3d899

SHA512
e6a1148e2883d07c862e976bea2fc17f7aed6e25de04f4cd90657ea1df145224ed2286e7f34ece9fb94d0fa5d547673bdd7c9e64649ad44ddcbd77802c3063fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4287.exe

Filesize
468KB

MD5
a843032d7771cab800c181532555da31

SHA1
709331e49714bf8f296abc8594ea3ac9410e2361

SHA256
fc7ca6af62dcb8915f26282c42b69acfe65468ae1a673bb9a62a69c7dab0764e

SHA512
f9b29762f1c532c58679209afa4f76c5791f7070a73ca231ea478793fad428beb019d4bb774d1c9ebd3fbb4d2edb95da0f3f0f6d821e1ef4215b3df51ed90fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4531.exe

Filesize
468KB

MD5
4fbefb1c35dbaafa2887befab7be1c5f

SHA1
f165cd580559c2d66c8f263bab1b4a656dc5b6a8

SHA256
95675668960bd115d2ce0f334b3cba6322a6df9ea118d7819d5a1ea6b49aa1d3

SHA512
e0a49df61a922711a0cd0598f43d12c276f1871a2eeb9c756f725076640a37cf0b8845ad78aa72372c990833010a6bc2c22e0b469e82f9cbf5253457f6a2dd79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe

Filesize
468KB

MD5
0173e4bf0ec0dec2cb55d777220b3cef

SHA1
13b1f6e93448edf5d9f9408fd625105271bfaac7

SHA256
a2b6554843e3ff45edc6ab63562053d1d838cf5d79ebf693e2178f9056aeb47b

SHA512
2024a3fc8d648204fe65dfdaf531346326b951b05427bb4d734232f36e13c8bd424d7686b8a677f5c06871115005e757aa14e7ec9566ccba1a2bc31579a454cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe

Filesize
468KB

MD5
d0fe13a17bbdb57fb0dbd08a56cd251d

SHA1
55f89477049db68ca1ec3584062df04b3c36016f

SHA256
de5ed4028aa1840328ae7321596a4f6b7352e9b0b1bf6fd1e33a7bfa5f7e73fc

SHA512
dbb8a575911204b1627d4348f545224b026a64d1d36964387320a7d606112ac68ff36610258a1198c2dc8d208f74242e9baa4c05c8f43482f81e5df8637fd3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47292.exe

Filesize
468KB

MD5
873c2355d362f92fe284157b453e6554

SHA1
076df4ba032987887c3ce6cd47928057d18b13a2

SHA256
1a60c6284f6d630992fd5d8b72d84628fa4b7a144b3dec22833f75ed9e715f08

SHA512
af3e0aa21156762a33e20af263994dc562aef9dba65cb2f5f692d0fc10e937fdea3cb1f5f4ced6191cf9a2973d1873a40e083295eb64d50e30dc9a239541f401

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50395.exe

Filesize
468KB

MD5
3716e0aaac10ac88da44ec4454c8c725

SHA1
574f3ed0f8be191a1377d09681ab2e505b530853

SHA256
9c569a1afeb531b3ecf42909ed522fc87e89e0fc5e991002b94c3c920c8512e8

SHA512
74d40105664952404d4adb643a8756eb898eb5972cc236c9e104a55f285a71c8bd526d857ddcfd8cbe4d46affd052f0e60323dbdb97ea34fc34063ffbc7e2bb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50516.exe

Filesize
468KB

MD5
fd389f72513f30d65c9ece9e47d222f6

SHA1
81428a9d580bddd4581ff8e03a63669843113c2b

SHA256
ee8a7cd47b6e40dbd2e8eaca3e1f93fd19854e7faf8d3f752a3b455146f4406a

SHA512
8524e62d9825b04564e041cd813fff861f9823f4df8784e6c4bc59318961fdcc9143bdb11f62d198186a0a65a3a05046d239047f3e34ecc86274d98f00622978

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe

Filesize
468KB

MD5
8453052e8d74771d3e72eb8a8d2d7ecc

SHA1
10fe025240eaa73e6cbf9c9f307dce81dca2fca0

SHA256
775f63901725fa8e91527dcce9bcdc6b538105a318913cdcfc607f7078080256

SHA512
fbd6fb6dd69ed8ab54ca4beac664c8eb2e9066b814b5b5733cd659aee4612ef464cb1ed254b836e326b081ef545ce6f00f438698d1ecba97732accb9cdcdc613

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe

Filesize
468KB

MD5
c2de08d1dfba6d0c72d771e6413f5931

SHA1
92c4c727ecdc075e88589247651d277d6941dc4e

SHA256
d0fbe2ab797ca47a9563fc4a08c1ab93782292fe6ec07e2d0516625a6984068e

SHA512
ec54d88c544fcf84af783894d0db0745b2d86c0a3e7fdcd5ac2fba00838777c913a8abe16f1a07842fa76302a47598c241bec87d574e97cdef2b891f2c0bd85c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57456.exe

Filesize
468KB

MD5
f02c40afa777508843d60eb8027114c6

SHA1
2c66a64793c64398483d477eff9df478641e58d9

SHA256
966bd25f9df9afee9cba93a32ed7ff213f116435331139d2685cb4b507ca1896

SHA512
f7b7840e922fa1ad8f6aec792f4f99a70e08dcdea326b5b16a50113bc6e6bfa42759fff0a4d12e632f2eda912ac4e7b72d375652c41bbc79ca3362c3940e30b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe

Filesize
468KB

MD5
5d4514c35d3b1ad9275a59633f80921d

SHA1
5a4ee6e6e8751b8e35f4540a9518cf2c7d3a914f

SHA256
64f8a8b479c93de777bf819e9dd26dbe26e432b34f5202a784300dc91590a974

SHA512
05df57bc7886d511d44da79cb20e584358aab4e58fc82dc26f537caf53d163ece4042962662e6a8807ba86e165c5589b5a291fecab7b2f1213cf42e45ec30dfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe

Filesize
468KB

MD5
3e8e04b2c08cfb1e5736b139734255f8

SHA1
c64819d7e75f0b702432c6f47a4775e2a0757324

SHA256
d719858e3123f09ea13f06dde1f18df7dc60801ea357a331d84934e1b5d60ac1

SHA512
8efb7f12beb2db86a760d164dd715c139116ae630d2ffc52eb374aa9471217aa208bcb4cb10b845a7a18f4de00129385a962d1fa9a89aaa8974e6bef9fa1d212

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe

Filesize
468KB

MD5
8fd5bf8fe1e82fb336446a3bdd2ef8c4

SHA1
587dc1c17198e65b1e5b8e90a2d29fa6c9d0d7b6

SHA256
55670671a92799847fe25898c7df86c09b3fc214ab8da349a4ca681aec320f6a

SHA512
6f15a28b18ad171039fdf2cd62148a83564dd28ee0cba53320173f47d729ec0353561d1f6c2b69d8164e3946f76247afbad4976f5f9f4c1d132fe696175de947

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9938.exe

Filesize
468KB

MD5
1871d1858869545847213417853417ed

SHA1
470573c2a97aaff636f1074860261ebc5cb2edcc

SHA256
0913f9ccb78af5ae5c76e9c7ef6230da4b783e07d35fcee0509d7eb6bc390082

SHA512
eb92a6257c647ee3522cc9ef5a2b01aa56e266219f94e502beb7ebe50d79d4c85b18e5cc6df9a7982d9650e27fc6b978da6b5ed06aed1c5c7cc83183db0976d8

Download Submit
memory/8-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/372-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/436-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/444-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/544-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/636-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/784-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/864-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/932-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/980-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/984-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1112-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1144-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1260-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1364-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1448-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1452-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1512-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1740-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1784-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1880-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2064-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2964-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3060-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3080-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3084-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3244-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3344-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3552-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3572-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3576-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3612-149-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3628-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3936-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3968-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3976-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3976-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3988-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4140-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4148-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4160-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4496-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4816-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5056-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5260-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5296-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5308-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5384-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5436-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5544-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5640-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5696-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5712-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5720-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5744-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5760-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5860-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5884-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5912-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5964-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6076-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13468-2506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14560-2453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14648-2460-0x00007FFDB7B90000-0x00007FFDB7D85000-memory.dmp

Filesize
2.0MB

Download
memory/15884-2452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads