3ea0bb2ee11caa87e48476970486ebee364f2c60f40ad289fd9fed4a235138ca

Analysis

max time kernel
116s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaf161f449f2ad2482eb0aa77a1f7020N.exe
Size

468KB
MD5

eaf161f449f2ad2482eb0aa77a1f7020
SHA1

49be90e18a200145eba166ef0675b0f6f3218551
SHA256

3ea0bb2ee11caa87e48476970486ebee364f2c60f40ad289fd9fed4a235138ca
SHA512

e02e8bcfeccfead2b8405c3b90d7fbbd322f242d5e9f188b66004c2383950d5bdb894cb3d161b8c035129c6f7d67533d891216d8d1229c4bf4b1593e3e54b8be
SSDEEP

3072:1buhogIdI05UtbYJHzcjcfu/EChyPIpdnLH0iVPTYawLKsVubaeL:1boow8UtOH4jcfN0KCYa6rVub

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4084	Unicorn-40941.exe
3232	Unicorn-23619.exe
3116	Unicorn-65206.exe
1772	Unicorn-57635.exe
3336	Unicorn-59673.exe
700	Unicorn-53551.exe
2488	Unicorn-33685.exe
2368	Unicorn-12.exe
4720	Unicorn-41599.exe
2448	Unicorn-16349.exe
1404	Unicorn-12264.exe
916	Unicorn-42726.exe
116	Unicorn-49113.exe
4404	Unicorn-35377.exe
1740	Unicorn-63172.exe
3080	Unicorn-39867.exe
5088	Unicorn-28169.exe
4580	Unicorn-64947.exe
4556	Unicorn-32174.exe
5000	Unicorn-11662.exe
620	Unicorn-47220.exe
4840	Unicorn-32275.exe
1612	Unicorn-28191.exe
2724	Unicorn-13800.exe
2396	Unicorn-42481.exe
5076	Unicorn-48611.exe
3800	Unicorn-39681.exe
2100	Unicorn-32829.exe
3716	Unicorn-44262.exe
1068	Unicorn-29242.exe
552	Unicorn-43541.exe
2820	Unicorn-58486.exe
3972	Unicorn-49763.exe
5004	Unicorn-370.exe
2484	Unicorn-20791.exe
3024	Unicorn-2508.exe
444	Unicorn-44096.exe
904	Unicorn-29151.exe
2432	Unicorn-23020.exe
3484	Unicorn-62134.exe
1436	Unicorn-64437.exe
1072	Unicorn-62954.exe
4516	Unicorn-29727.exe
4628	Unicorn-10490.exe
4356	Unicorn-19421.exe
3848	Unicorn-34365.exe
2216	Unicorn-754.exe
4588	Unicorn-57162.exe
4212	Unicorn-43468.exe
2060	Unicorn-60069.exe
2392	Unicorn-39649.exe
2528	Unicorn-48564.exe
3220	Unicorn-64345.exe
224	Unicorn-23404.exe
2532	Unicorn-60069.exe
4928	Unicorn-44480.exe
3828	Unicorn-3852.exe
1528	Unicorn-11755.exe
1196	Unicorn-20189.exe
1740	Unicorn-16105.exe
3692	Unicorn-52953.exe
4312	Unicorn-39217.exe
3112	Unicorn-9690.exe
4816	Unicorn-48585.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4384	1740	WerFault.exe	107
1116	904	WerFault.exe	134
16844	2268	WerFault.exe	873

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15637.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6492	dwm.exe
Token: SeChangeNotifyPrivilege	6492	dwm.exe
Token: 33	6492	dwm.exe
Token: SeIncBasePriorityPrivilege	6492	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4872	eaf161f449f2ad2482eb0aa77a1f7020N.exe
4084	Unicorn-40941.exe
3232	Unicorn-23619.exe
3116	Unicorn-65206.exe
1772	Unicorn-57635.exe
3336	Unicorn-59673.exe
2488	Unicorn-33685.exe
700	Unicorn-53551.exe
2368	Unicorn-12.exe
4720	Unicorn-41599.exe
2448	Unicorn-16349.exe
4404	Unicorn-35377.exe
116	Unicorn-49113.exe
916	Unicorn-42726.exe
1404	Unicorn-12264.exe
1740	Unicorn-63172.exe
3080	Unicorn-39867.exe
5088	Unicorn-28169.exe
4580	Unicorn-64947.exe
4556	Unicorn-32174.exe
4840	Unicorn-32275.exe
5000	Unicorn-11662.exe
620	Unicorn-47220.exe
3716	Unicorn-44262.exe
1612	Unicorn-28191.exe
2100	Unicorn-32829.exe
2396	Unicorn-42481.exe
5076	Unicorn-48611.exe
3800	Unicorn-39681.exe
2724	Unicorn-13800.exe
1068	Unicorn-29242.exe
552	Unicorn-43541.exe
2820	Unicorn-58486.exe
3972	Unicorn-49763.exe
5004	Unicorn-370.exe
2484	Unicorn-20791.exe
3024	Unicorn-2508.exe
904	Unicorn-29151.exe
444	Unicorn-44096.exe
2432	Unicorn-23020.exe
3484	Unicorn-62134.exe
1436	Unicorn-64437.exe
1072	Unicorn-62954.exe
4516	Unicorn-29727.exe
4628	Unicorn-10490.exe
4356	Unicorn-19421.exe
3848	Unicorn-34365.exe
4588	Unicorn-57162.exe
2060	Unicorn-60069.exe
2528	Unicorn-48564.exe
4212	Unicorn-43468.exe
2392	Unicorn-39649.exe
2216	Unicorn-754.exe
2532	Unicorn-60069.exe
224	Unicorn-23404.exe
3220	Unicorn-64345.exe
4928	Unicorn-44480.exe
3828	Unicorn-3852.exe
1528	Unicorn-11755.exe
1196	Unicorn-20189.exe
3692	Unicorn-52953.exe
4312	Unicorn-39217.exe
1740	Unicorn-16105.exe
3112	Unicorn-9690.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4084	4872	eaf161f449f2ad2482eb0aa77a1f7020N.exe	90
PID 4872 wrote to memory of 4084	4872	eaf161f449f2ad2482eb0aa77a1f7020N.exe	90
PID 4872 wrote to memory of 4084	4872	eaf161f449f2ad2482eb0aa77a1f7020N.exe	90
PID 4084 wrote to memory of 3232	4084	Unicorn-40941.exe	92
PID 4084 wrote to memory of 3232	4084	Unicorn-40941.exe	92
PID 4084 wrote to memory of 3232	4084	Unicorn-40941.exe	92
PID 4872 wrote to memory of 3116	4872	eaf161f449f2ad2482eb0aa77a1f7020N.exe	93
PID 4872 wrote to memory of 3116	4872	eaf161f449f2ad2482eb0aa77a1f7020N.exe	93
PID 4872 wrote to memory of 3116	4872	eaf161f449f2ad2482eb0aa77a1f7020N.exe	93
PID 3232 wrote to memory of 1772	3232	Unicorn-23619.exe	96
PID 3232 wrote to memory of 1772	3232	Unicorn-23619.exe	96
PID 3232 wrote to memory of 1772	3232	Unicorn-23619.exe	96
PID 4872 wrote to memory of 3336	4872	eaf161f449f2ad2482eb0aa77a1f7020N.exe	99
PID 4872 wrote to memory of 3336	4872	eaf161f449f2ad2482eb0aa77a1f7020N.exe	99
PID 4872 wrote to memory of 3336	4872	eaf161f449f2ad2482eb0aa77a1f7020N.exe	99
PID 3116 wrote to memory of 700	3116	Unicorn-65206.exe	98
PID 3116 wrote to memory of 700	3116	Unicorn-65206.exe	98
PID 3116 wrote to memory of 700	3116	Unicorn-65206.exe	98
PID 4084 wrote to memory of 2488	4084	Unicorn-40941.exe	97
PID 4084 wrote to memory of 2488	4084	Unicorn-40941.exe	97
PID 4084 wrote to memory of 2488	4084	Unicorn-40941.exe	97
PID 1772 wrote to memory of 2368	1772	Unicorn-57635.exe	100
PID 1772 wrote to memory of 2368	1772	Unicorn-57635.exe	100
PID 1772 wrote to memory of 2368	1772	Unicorn-57635.exe	100
PID 3232 wrote to memory of 4720	3232	Unicorn-23619.exe	101
PID 3232 wrote to memory of 4720	3232	Unicorn-23619.exe	101
PID 3232 wrote to memory of 4720	3232	Unicorn-23619.exe	101
PID 2488 wrote to memory of 2448	2488	Unicorn-33685.exe	102
PID 2488 wrote to memory of 2448	2488	Unicorn-33685.exe	102
PID 2488 wrote to memory of 2448	2488	Unicorn-33685.exe	102
PID 700 wrote to memory of 1404	700	Unicorn-53551.exe	103
PID 700 wrote to memory of 1404	700	Unicorn-53551.exe	103
PID 700 wrote to memory of 1404	700	Unicorn-53551.exe	103
PID 4872 wrote to memory of 916	4872	eaf161f449f2ad2482eb0aa77a1f7020N.exe	104
PID 4872 wrote to memory of 916	4872	eaf161f449f2ad2482eb0aa77a1f7020N.exe	104
PID 4872 wrote to memory of 916	4872	eaf161f449f2ad2482eb0aa77a1f7020N.exe	104
PID 4084 wrote to memory of 116	4084	Unicorn-40941.exe	106
PID 4084 wrote to memory of 116	4084	Unicorn-40941.exe	106
PID 4084 wrote to memory of 116	4084	Unicorn-40941.exe	106
PID 3116 wrote to memory of 4404	3116	Unicorn-65206.exe	105
PID 3116 wrote to memory of 4404	3116	Unicorn-65206.exe	105
PID 3116 wrote to memory of 4404	3116	Unicorn-65206.exe	105
PID 3336 wrote to memory of 1740	3336	Unicorn-59673.exe	155
PID 3336 wrote to memory of 1740	3336	Unicorn-59673.exe	155
PID 3336 wrote to memory of 1740	3336	Unicorn-59673.exe	155
PID 2368 wrote to memory of 3080	2368	Unicorn-12.exe	111
PID 2368 wrote to memory of 3080	2368	Unicorn-12.exe	111
PID 2368 wrote to memory of 3080	2368	Unicorn-12.exe	111
PID 1772 wrote to memory of 5088	1772	Unicorn-57635.exe	112
PID 1772 wrote to memory of 5088	1772	Unicorn-57635.exe	112
PID 1772 wrote to memory of 5088	1772	Unicorn-57635.exe	112
PID 4720 wrote to memory of 4580	4720	Unicorn-41599.exe	113
PID 4720 wrote to memory of 4580	4720	Unicorn-41599.exe	113
PID 4720 wrote to memory of 4580	4720	Unicorn-41599.exe	113
PID 3232 wrote to memory of 4556	3232	Unicorn-23619.exe	114
PID 3232 wrote to memory of 4556	3232	Unicorn-23619.exe	114
PID 3232 wrote to memory of 4556	3232	Unicorn-23619.exe	114
PID 2448 wrote to memory of 5000	2448	Unicorn-16349.exe	115
PID 2448 wrote to memory of 5000	2448	Unicorn-16349.exe	115
PID 2448 wrote to memory of 5000	2448	Unicorn-16349.exe	115
PID 2488 wrote to memory of 620	2488	Unicorn-33685.exe	116
PID 2488 wrote to memory of 620	2488	Unicorn-33685.exe	116
PID 2488 wrote to memory of 620	2488	Unicorn-33685.exe	116
PID 4404 wrote to memory of 4840	4404	Unicorn-35377.exe	117

C:\Users\Admin\AppData\Local\Temp\eaf161f449f2ad2482eb0aa77a1f7020N.exe
"C:\Users\Admin\AppData\Local\Temp\eaf161f449f2ad2482eb0aa77a1f7020N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23619.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57635.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        9⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        10⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44465.exe
        11⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
        11⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21062.exe
        11⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20541.exe
        10⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33394.exe
        10⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
        9⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe
        10⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5627.exe
        10⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
        9⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65492.exe
        9⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
        9⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5367.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exe
        9⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55155.exe
        10⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        10⤵
        
        PID:17012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34713.exe
        9⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
        9⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60665.exe
        9⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
        8⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        8⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39217.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        8⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36987.exe
        9⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        9⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        9⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        8⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
        8⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        8⤵
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exe
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        9⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        9⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14790.exe
        8⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        8⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49123.exe
        7⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        7⤵
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        8⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        9⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45643.exe
        10⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        10⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20732.exe
        9⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        9⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27619.exe
        8⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63031.exe
        8⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51678.exe
        8⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        8⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42471.exe
        8⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
        8⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22880.exe
        7⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41076.exe
        7⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18892.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52953.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56499.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46551.exe
        8⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        8⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62010.exe
        8⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33194.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41843.exe
        7⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7708.exe
        8⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32077.exe
        8⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        8⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39260.exe
        7⤵
        
        PID:14092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29592.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5684.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15996.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe
        6⤵
        
        PID:11956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe
        6⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28169.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49763.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9690.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41917.exe
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4314.exe
        9⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1055.exe
        9⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
        9⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
        9⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
        8⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20847.exe
        8⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        8⤵
        
        PID:16704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22627.exe
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        8⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        9⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
        8⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
        8⤵
        
        PID:16712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13525.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61575.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe
        7⤵
        
        PID:16728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        6⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7106.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46551.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        9⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57838.exe
        9⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32409.exe
        8⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33010.exe
        8⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10173.exe
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10541.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        8⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        8⤵
        
        PID:17140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56223.exe
        8⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6123.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19694.exe
        7⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        7⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exe
        7⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
        8⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        8⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        7⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
        7⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45274.exe
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11990.exe
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
        6⤵
        
        PID:16192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40775.exe
        6⤵
        
        PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38771.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-592.exe
        7⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53833.exe
        7⤵
        
        PID:17120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
        6⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41076.exe
        6⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
        6⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50842.exe
        5⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        7⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
        7⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
        7⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56592.exe
        6⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26850.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        6⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        6⤵
        
        PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2810.exe
        5⤵
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45726.exe
        6⤵
        
        PID:14100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        6⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        6⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        5⤵
        
        PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        5⤵
        
        PID:13780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41599.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-370.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48585.exe
        7⤵
        Executes dropped EXE
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52223.exe
        8⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
        9⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        9⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2067.exe
        9⤵
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
        8⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        9⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        9⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56223.exe
        9⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
        8⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        8⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53354.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        8⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65461.exe
        9⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        9⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
        9⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exe
        8⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        8⤵
        
        PID:15440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8453.exe
        8⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
        7⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16531.exe
        8⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63058.exe
        7⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        7⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6161.exe
        6⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        8⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        9⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27171.exe
        9⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49104.exe
        8⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        8⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
        8⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9145.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20628.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33780.exe
        7⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        7⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52315.exe
        6⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
        7⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        6⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54437.exe
        7⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39305.exe
        6⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38637.exe
        6⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44096.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        6⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35887.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        8⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5243.exe
        8⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        8⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
        7⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55658.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37297.exe
        7⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        6⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exe
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
        8⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23663.exe
        8⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59627.exe
        7⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17931.exe
        7⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
        7⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        6⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        6⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        6⤵
        
        PID:16172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        6⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        5⤵
        
        PID:208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
        6⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56032.exe
        7⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6638.exe
        7⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52969.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        6⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
        6⤵
        
        PID:16812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        5⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        6⤵
        
        PID:11200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        6⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14313.exe
        5⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59085.exe
        5⤵
        
        PID:16636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2508.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6182.exe
        6⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35887.exe
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        8⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        8⤵
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5575.exe
        8⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28003.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11657.exe
        7⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        7⤵
        
        PID:16848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32607.exe
        7⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
        6⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39793.exe
        6⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63058.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        6⤵
        
        PID:16892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        5⤵
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57459.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1247.exe
        7⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3986.exe
        7⤵
        
        PID:16824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38876.exe
        6⤵
        
        PID:13392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32291.exe
        6⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe
        5⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        5⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe
        5⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        5⤵
        
        PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24657.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2560.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        8⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        8⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44034.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
        7⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        6⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1683.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        6⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        6⤵
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6866.exe
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
        5⤵
        
        PID:13768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        6⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
        6⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
        6⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
        5⤵
        
        PID:13508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12383.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24630.exe
        5⤵
        
        PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
      4⤵
      PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
      4⤵
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
      4⤵
      PID:13964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29151.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 720
        7⤵
        Program crash
        
        PID:1116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        6⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18373.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13852.exe
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exe
        8⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
        8⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        8⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48606.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        7⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13394.exe
        6⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        7⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
        7⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        6⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54969.exe
        6⤵
        
        PID:11988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
        6⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62954.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exe
        6⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57459.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14428.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        8⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58641.exe
        8⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        8⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30934.exe
        7⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38745.exe
        6⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
        7⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        7⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        7⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38876.exe
        6⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36318.exe
        6⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 88
        7⤵
        Program crash
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        6⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41469.exe
        5⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
        6⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57895.exe
        7⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37723.exe
        7⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6123.exe
        7⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        6⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
        6⤵
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58730.exe
        5⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        6⤵
        
        PID:10928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30925.exe
        6⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19705.exe
        5⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4368.exe
        5⤵
        
        PID:16840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23927.exe
        5⤵
        
        PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63551.exe
        6⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5160.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53240.exe
        8⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35403.exe
        8⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9851.exe
        8⤵
        
        PID:16804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5061.exe
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20628.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        7⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        7⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        6⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        7⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        7⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61738.exe
        7⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63058.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        6⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
        6⤵
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26597.exe
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63136.exe
        7⤵
        
        PID:16676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28003.exe
        6⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        6⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        6⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63197.exe
        5⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45643.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
        6⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        6⤵
        
        PID:16664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
        5⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        5⤵
        
        PID:16336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53453.exe
        6⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10531.exe
        6⤵
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
        6⤵
        
        PID:15344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18796.exe
        5⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        5⤵
        
        PID:16200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30998.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57132.exe
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43187.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        6⤵
        
        PID:15220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56207.exe
        5⤵
        
        PID:12528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        5⤵
        
        PID:16412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
      4⤵
      PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        5⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        5⤵
        
        PID:15944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58304.exe
      4⤵
      PID:9412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22764.exe
      4⤵
      PID:14004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49113.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41355.exe
        5⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30817.exe
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        7⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
        7⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12066.exe
        7⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39233.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31858.exe
        6⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
        6⤵
        
        PID:17304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56565.exe
        5⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        6⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39119.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
        6⤵
        
        PID:10516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28876.exe
        5⤵
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56853.exe
        5⤵
        
        PID:13716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48564.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17387.exe
        6⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
        7⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        7⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        6⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        6⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        6⤵
        
        PID:17256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60126.exe
        5⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        6⤵
        
        PID:14576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43999.exe
        5⤵
        
        PID:13912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
        6⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        6⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31142.exe
        6⤵
        
        PID:16664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        6⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19197.exe
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        5⤵
        
        PID:12512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40621.exe
        5⤵
        
        PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
        5⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        5⤵
        
        PID:16924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13867.exe
      4⤵
      PID:14168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44262.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
        5⤵
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58969.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        7⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        7⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43264.exe
        7⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40255.exe
        6⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38373.exe
        7⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        7⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62944.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1350.exe
        6⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        5⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48549.exe
        6⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        6⤵
        
        PID:15368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55873.exe
        6⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
        5⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57315.exe
        5⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        5⤵
        
        PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
      4⤵
      PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42083.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45861.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
        6⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        5⤵
        
        PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9981.exe
        5⤵
        
        PID:828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3289.exe
        5⤵
        
        PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14546.exe
      4⤵
      PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1247.exe
      4⤵
      PID:10684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51783.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10490.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38985.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10344.exe
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43457.exe
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        6⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        6⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe
        5⤵
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-208.exe
        5⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        5⤵
        
        PID:15128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42829.exe
      4⤵
      PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13380.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
        5⤵
        
        PID:15312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
      4⤵
      PID:9784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
      4⤵
      PID:13820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62974.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
      4⤵
      PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        5⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21221.exe
        5⤵
        
        PID:13856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18262.exe
        5⤵
        
        PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
      4⤵
      PID:10460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
      4⤵
      PID:13680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16659.exe
      4⤵
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      4⤵
      PID:9136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
    3⤵
    PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exe
      4⤵
      PID:12012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61372.exe
      4⤵
      PID:16408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
    3⤵
    PID:9628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40631.exe
    3⤵
    PID:13828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65206.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65206.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53551.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12264.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48611.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2290.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        9⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        9⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        9⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
        9⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        8⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30934.exe
        8⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        8⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51766.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        8⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
        7⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
        7⤵
        
        PID:14044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50251.exe
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
        8⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        8⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16011.exe
        7⤵
        
        PID:17312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        7⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe
        7⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62883.exe
        6⤵
        
        PID:14324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe
        6⤵
        
        PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44480.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
        7⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10142.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        8⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61574.exe
        7⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-146.exe
        7⤵
        
        PID:14304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38143.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        7⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
        7⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64017.exe
        6⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65492.exe
        6⤵
        
        PID:14436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        6⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42379.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
        7⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3986.exe
        7⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21335.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exe
        6⤵
        
        PID:13084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9981.exe
        6⤵
        
        PID:16568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        5⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        6⤵
        
        PID:13492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
        6⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58119.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        5⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5741.exe
        5⤵
        
        PID:8340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32829.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64345.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
        6⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64615.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42265.exe
        8⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        8⤵
        
        PID:16916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42384.exe
        7⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1316.exe
        7⤵
        
        PID:16820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6156.exe
        7⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37541.exe
        6⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        7⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe
        7⤵
        
        PID:17284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50395.exe
        6⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        6⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62796.exe
        6⤵
        
        PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50251.exe
        6⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25119.exe
        7⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43457.exe
        7⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        7⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
        7⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
        6⤵
        
        PID:8404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45325.exe
        6⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        6⤵
        
        PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-156.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32597.exe
        6⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
        6⤵
        
        PID:15892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
        6⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57630.exe
        5⤵
        
        PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28046.exe
        5⤵
        
        PID:13532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        6⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31855.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56913.exe
        7⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        6⤵
        
        PID:12944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25742.exe
        6⤵
        
        PID:17348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        6⤵
        
        PID:16888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        5⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        6⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exe
        6⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        6⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
        5⤵
        
        PID:12076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
        5⤵
        
        PID:16216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        5⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7712.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        6⤵
        
        PID:17292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        5⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54993.exe
        5⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        5⤵
        
        PID:17324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
      4⤵
      PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
        5⤵
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        5⤵
        
        PID:14508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13628.exe
        5⤵
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40934.exe
        5⤵
        
        PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
      4⤵
      PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35377.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
        6⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22265.exe
        7⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
        8⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3410.exe
        8⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-285.exe
        8⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        7⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37733.exe
        7⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63136.exe
        7⤵
        
        PID:16668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3551.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19603.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25305.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43971.exe
        7⤵
        
        PID:16908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        6⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe
        6⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58268.exe
        6⤵
        
        PID:17080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44880.exe
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        6⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        6⤵
        
        PID:14424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55772.exe
        5⤵
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54393.exe
        5⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64002.exe
        5⤵
        
        PID:15836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34365.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59659.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-858.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4610.exe
        7⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        7⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        6⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        6⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
        6⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47682.exe
        5⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        6⤵
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11411.exe
        6⤵
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39452.exe
        5⤵
        
        PID:13576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
        5⤵
        
        PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe
        6⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24598.exe
        6⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        5⤵
        
        PID:13684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
      4⤵
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7712.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19493.exe
        5⤵
        
        PID:17316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
      4⤵
      PID:11188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
      4⤵
      PID:14464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42481.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-754.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16681.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34657.exe
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe
        6⤵
        
        PID:11384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57079.exe
        6⤵
        
        PID:14696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exe
        5⤵
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41076.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54279.exe
        5⤵
        
        PID:14980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
      4⤵
      PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
        5⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        6⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47184.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33394.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63171.exe
      4⤵
      PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe
        5⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        5⤵
        
        PID:13452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39119.exe
        5⤵
        
        PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
      4⤵
      PID:10048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27463.exe
      4⤵
      PID:13724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29550.exe
      4⤵
      PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43468.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14542.exe
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37423.exe
        5⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        6⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exe
        6⤵
        
        PID:11360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        6⤵
        
        PID:15448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        6⤵
        
        PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5445.exe
        5⤵
        
        PID:8380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45325.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63136.exe
        5⤵
        
        PID:16684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-235.exe
      4⤵
      PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23163.exe
        5⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        5⤵
        
        PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
      4⤵
      PID:10072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3542.exe
      4⤵
      PID:6888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61035.exe
    3⤵
    PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50251.exe
      4⤵
      PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50687.exe
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14484.exe
        5⤵
        
        PID:15308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        5⤵
        
        PID:14728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
      4⤵
      PID:12792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22233.exe
      4⤵
      PID:17008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38099.exe
      4⤵
      PID:8160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27883.exe
    3⤵
    PID:7212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10666.exe
      4⤵
      PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
      4⤵
      PID:13516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
      4⤵
      PID:4340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
    3⤵
    PID:9428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9402.exe
    3⤵
    PID:14156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63172.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 492
      4⤵
      Program crash
      PID:4384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21341.exe
        5⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46551.exe
        6⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57485.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41511.exe
        7⤵
        
        PID:16832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62010.exe
        6⤵
        
        PID:13352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-811.exe
        5⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
        5⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        5⤵
        
        PID:14188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
      4⤵
      PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
        5⤵
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21475.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
        5⤵
        
        PID:16208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41355.exe
      4⤵
      PID:7552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
      4⤵
      PID:11552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25114.exe
      4⤵
      PID:15664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27985.exe
      4⤵
      PID:7692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45653.exe
      4⤵
      PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46551.exe
        5⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43213.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27200.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17242.exe
        5⤵
        
        PID:16864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
      4⤵
      PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        5⤵
        
        PID:13284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
        5⤵
        
        PID:16888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
      4⤵
      PID:11176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56827.exe
      4⤵
      PID:14472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10080.exe
    3⤵
    PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43457.exe
      4⤵
      PID:11736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
      4⤵
      PID:15884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
      4⤵
      PID:8868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
    3⤵
    PID:7956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
    3⤵
    PID:11980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
    3⤵
    PID:16068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42726.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42726.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28191.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-344.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50251.exe
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        6⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe
        6⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
        5⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18397.exe
        5⤵
        
        PID:12692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        5⤵
        
        PID:16780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-858.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57895.exe
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        6⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        6⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        5⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        5⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-443.exe
        5⤵
        
        PID:17048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exe
        5⤵
        
        PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
      4⤵
      PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53074.exe
        5⤵
        
        PID:15756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        5⤵
        
        PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29644.exe
      4⤵
      PID:10220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26510.exe
      4⤵
      PID:14020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
      4⤵
      PID:7316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59367.exe
    3⤵
    PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
      4⤵
      PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        5⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2922.exe
        5⤵
        
        PID:12556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
      4⤵
      PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51739.exe
      4⤵
      PID:12192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
      4⤵
      PID:16312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30514.exe
      4⤵
      PID:8972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-977.exe
    3⤵
    PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
      4⤵
      PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
      4⤵
      PID:15992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
    3⤵
    PID:13424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
    3⤵
    PID:16864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exe
    3⤵
    PID:8516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50251.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        6⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53186.exe
        6⤵
        
        PID:7604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        5⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63136.exe
        5⤵
        
        PID:16656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
      4⤵
      PID:8148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31855.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20924.exe
        5⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        5⤵
        
        PID:10256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
      4⤵
      PID:11144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56827.exe
      4⤵
      PID:14532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58268.exe
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35129.exe
      4⤵
      PID:1040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
    3⤵
    PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
      4⤵
      PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36987.exe
        5⤵
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
        5⤵
        
        PID:11472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
        5⤵
        
        PID:15700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6123.exe
        5⤵
        
        PID:8524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40795.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56966.exe
        5⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
        5⤵
        
        PID:8768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-208.exe
      4⤵
      PID:11568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
      4⤵
      PID:14416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
    3⤵
    PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
      4⤵
      PID:14612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23806.exe
    3⤵
    PID:10080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
    3⤵
    PID:14256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44324.exe
    3⤵
    PID:9516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
    3⤵
    PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37999.exe
      4⤵
      PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        5⤵
        
        PID:13712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
      4⤵
      PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
      4⤵
      PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44216.exe
      4⤵
      PID:17264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13979.exe
      4⤵
      PID:8916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45352.exe
    3⤵
    PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
      4⤵
      PID:9896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
      4⤵
      PID:13744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
      4⤵
      PID:10244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
    3⤵
    PID:10064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53650.exe
    3⤵
    PID:14272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26755.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26755.exe
  2⤵
  PID:5476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
      4⤵
      PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
      4⤵
      PID:11128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38632.exe
      4⤵
      PID:16044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
    3⤵
    PID:9072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
    3⤵
    PID:17056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
  2⤵
  PID:7228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34017.exe
    3⤵
    PID:5636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48503.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48503.exe
  2⤵
  PID:10396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10789.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10789.exe
  2⤵
  PID:12112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
  2⤵
  PID:7616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1740 -ip 1740
1⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 904 -ip 904
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6580 -ip 6580
1⤵
PID:1904

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe

Filesize
468KB

MD5
6a833a3507d54e689ae382783389001e

SHA1
352440e0dc8f3b8f529f732bbba69627f18a7bae

SHA256
ae44f4d8ba1e11bb98005d3c8468380ee68bb88980470091aedae09462b22067

SHA512
c6728e4426d987de88b920226345dd5a4bc5fc296d91aa5d739431ced576f76758ecff21ae5b8b150a4b3739c785b1c1b658f7b562e466e6701668cd6095eae4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe

Filesize
468KB

MD5
66d012d4cdff4458f1324e6bb9cf1bdf

SHA1
15ba35abdb4933ca30abe0bfb63ba31bd7bdc03b

SHA256
874da13518ed54dc1543d09fed98ca9a7713b734b70d6adf82a5c5335632a91b

SHA512
b50624da139f419f09a9b9f89918a4ac78a6c8f200eb8aa9a5029c3b79339cf47979885610823ea056b3e65a35bbbb35253dde1881811863117b1b06b836dc5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12264.exe

Filesize
468KB

MD5
4fdaf848e3a9bb2cf6b70fbd8e165baf

SHA1
f1ff260502b63a5f772d5624e035d397b38113f9

SHA256
54890971c382c8ddd5cf84b700acd85af861140904e746917d7646183868aeda

SHA512
0db4ebcb56c77b494bad96aeea162bafdfcc815b06fb4b4553389f5b20233e2ab0cb4c6035e2e99aa404e74336f47f742f128250d541009d2facdea898384839

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe

Filesize
468KB

MD5
e09c88fa5b4c674e004d06de42ce411b

SHA1
2d7c6af512fdfc73b4ea7862c587bd696b90b38b

SHA256
b6ae52cc9d3f41b85fc5d34af2ad59d1262677fcf470ac9402dde89585859bc8

SHA512
90c6e69dcd28dad268405e407eff18d1a0f510801bf501e50e3e9dd8c9bc74699ab06447021df9a550bc5e37da9b9747471ac02571bf9af0f442701547706596

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe

Filesize
468KB

MD5
99ca85f0f1a35ceed9ebcd7ce5b696e1

SHA1
7afd7c95c140e1dda05120d7a8677d5ee5fc0657

SHA256
abe95630d8526d83205ebf65746b92510e957ca870893d8fd60be4d53cc38c3b

SHA512
d73bd473142d539d2c317d44a6439e3e9201cdd2ba7c83890986259e171b37814ffd1820b393be5159650d7ef982fb38c33311d3079b25fb69d59352da74cc1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23619.exe

Filesize
468KB

MD5
f178d38c2021a53a7ba151d36ea890f8

SHA1
2b429f4b250a701532868bcc8657cb35c701484b

SHA256
0b35b63f024a3f277c010e5a3f671a3e089294365f296f6645e17e14e7465404

SHA512
c4e52885db62906f322e4e144abe70a0f412bbdfa65617542d7933936e73f90b9488872c2c482517034dc2b97f2ea215e973f3daf998f71cd8cbaedfd0d3059e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28169.exe

Filesize
468KB

MD5
a10d62e740fd8881853835ee187083ca

SHA1
76da1ba34c91dc3f2a0b39b4fa6d77e6c7634973

SHA256
a52340e9bced07fdfaca6bd455e6f034b25d597976c41f0d34461b242cd86a12

SHA512
d7c41ea7048a1506d36c6c5b6d545c08991f363590566ab4a3f55b46d41e94f763632f977a3d929f656121f2a20f22148308d92225cdc7d0b8cb7e23dc315dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28191.exe

Filesize
468KB

MD5
770651b1989b7c6d14bbb76d01369f8d

SHA1
be6be9a049b04b403951f1bc6e26acde73a26abb

SHA256
45fbdbe7f29b679331f3cadfda1a0a32d28b5889724caf00da616e9e949965db

SHA512
f6e6ddd09c73a4d51d260b6b95947e72f8419224aa28e2ebc74cb665bd336f2f5d16030c37326d594df3d090bb7d004bf5b861f696129ecb36a02198ea71fa12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe

Filesize
468KB

MD5
1378779cfcffe111e0fedc01f0a7e472

SHA1
d264c96481ee5964d2ba79feaf8b5e413412a3ff

SHA256
9c6e51cb7d3f0c8159df9601b36ace620dba62fc37fa158883cab9059ffe34ce

SHA512
d7767166ceb902e101bb1f390b162108722a4c8e5196ad40567dc3878ba14c7313ec7c3057a4e47c71a06fc9fc74a36cdc78c90e793a83b811088f49a26c2eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe

Filesize
468KB

MD5
0dd7ff5d9ba4bcffd9dcdc582a0c4ba2

SHA1
93d2e12a36faa0beff421aba921bc3e9c6b5d728

SHA256
640a33a8b62c0093e8e750a82b73401962878c9d782c79a65ecfcd3f65930786

SHA512
27501c8d4ec3bf422f56bc6788909e58e7eb930a410fe38b3e14ad0e25bf4fab844760cd22357ca31882b901c43d66c969226b7aa86456233313219f6c3a2ef1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe

Filesize
468KB

MD5
8925831173170ac93a44dc1ab0490b32

SHA1
91256f6fc8974889e7ba0b7c0d502cb06d942534

SHA256
2cdac987b00fb39ee32050b8e483ec3464131fb5490a96722ac1cdeac0afc5d5

SHA512
cd407ac4209f409cbb000910a7a69f88258ceebc8be106275e191dc83e363729afcf4fa115aa99b8e4748bb4bfab12459e23835219c29a9e139ba63154af7e45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32829.exe

Filesize
468KB

MD5
814bcda3fc9015e88a987fa2e855a5d4

SHA1
8aa6ea0a7ed650bd4d2827ad2f03a10e4bf88744

SHA256
182821a2e3ee547efc9c1ce8a2d641401ae864b9ad67681def1063e909176108

SHA512
02386c0ba79a0839bfd7ffc59b5e3c02c09dee973da6a22caaef02bf5e97c537c0519125376252e3b05ca01d095569dcb980ac3adbb20d261d97778419db5324

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe

Filesize
468KB

MD5
8da1a71153284d180f3f3c3db7e82aac

SHA1
53475f5690e25f260074f438ae06a7ed5723441e

SHA256
44eb83eae1736078a38c4f2bd556dd9d43f3c23b783e3a1fe2470c98e8a5dc76

SHA512
7ef33d7885f82a43b056d4dff8fc4e1b285bec8181c085d9ccf50d18c12632101f74958c630520319375250ca45e3eea64e61384c3e8e24cec12c4a6bf0f3816

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35377.exe

Filesize
468KB

MD5
618b8e384179c2c50fb22929679eeff4

SHA1
1fba477543b83acc77d4027609217bc6ce1e0b6d

SHA256
0ecacd63df5482acf37d714344e38fe317d5d40c3ca8f696c8184fcd6e707fb7

SHA512
8eb7ee8fd988e03a0030d61511e6b89402cbb5ef745df9f0b258c1bfc70a0af18d7a2f37e5c7d0ea18075e74af8e1af55d51be05be102baaa2e1110828e5a486

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe

Filesize
468KB

MD5
2e942913648e7190d7f58dbb4251b9aa

SHA1
acecb451024571bb708bf2368108bbcd2ea233ed

SHA256
66e4b173a4e19c0222665ce515a33ed469eaa5ee1b7a8ff8eaafae30f9ba2313

SHA512
542a679b836fa421687c83eae36aa12a5305e979d25631cddd8421259b387cf8eaa5244106c920401844c6bf6f4497aa3ff178f9d81170a5429557a789dcb838

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe

Filesize
468KB

MD5
1fea48b167fb744f645e6c1d21f8814c

SHA1
2a001d258ee651d3bda911fc77e2e8ad2d70f398

SHA256
4c015103eeb9fd31d119179aa5832f59ecff09801c05d95ff5d12ab85fe4073c

SHA512
b434bef02441d1b61d66244a8f418c60289c4fa36bd1ec7fcca61fc51bb9241643a55b8da8bec3bb8816f33460f8ecacf205dfb4f07dad7c7454081f0546565d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe

Filesize
468KB

MD5
342cb45ff82a8188bc8b3ca0ab627d81

SHA1
ecd5b4e86aff58495a0de05a76604c86d0d61cac

SHA256
9bf741786cbd8b6a8dff175125da7dec9ad16532c4a5ce2f57c9d46c755ed401

SHA512
39e98bea6b3f29d3d88a923460db20f62900454b414cd35e9742c348713b8fa0eb475bf4917f73a68c4212c90c2316b8d7c57f7c33228531129b6958c7b0722a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41599.exe

Filesize
468KB

MD5
02d665e367042597d76b08314593be1b

SHA1
0bb15e6a3ff338aff569ca44448fb1b5cc22d52d

SHA256
be83516d1380f3470472c9a4477fe6336e1831adb17f928657f16e5f36714cf9

SHA512
8cee1bd1c52b4a7340e4230460bf22f4503886d9a5bc1b79a20b1a54ba2d8f4431ec5430f255b6645833d4ed85ad573fc2aa4aa3a183f900e825bfa48c7a44d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42481.exe

Filesize
468KB

MD5
3f9768aaa517cd894bbd861083e02e72

SHA1
eccafba632b83b3c888a47e18054ce9cd25d3e95

SHA256
cd60482b3a5abe42f75d004b1374764b41c38ab2bcd6c9e54c82afdec7bb1b4e

SHA512
60a58ca1eb334d70b85b0339bfaf0ac7358fbd71424e09509f3afc75d5ef0241bbb654e7dda85dddf212fca4746a2bf6587dec742c2ded3ea1b02184d1cdc7e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42726.exe

Filesize
468KB

MD5
5e91a35a23bb5909d7776dda81740d1d

SHA1
c8ba15c30561ea66eedf6d7b89721f1ba828893b

SHA256
b035bf70d190cc3c67627c24eb6693207fe3d6b212649b028e6bb5c571d74983

SHA512
43ef6b674445ff456a0af8ccb279f5cc262f3ebf69b3e0c12ffb15866b5fdae4067ae8a57679b96cd09ebab97bee74cfdffbb1163c4473c1817c016b41b79e21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe

Filesize
468KB

MD5
0404a430d34ba13d1156e13bd1ff4e5e

SHA1
81735c5e170c87ed3325a8f1b02ab1ae0fc03576

SHA256
fdb7cfae3f751f70c71163f88a0b748856531c4de6f7257e59f6ce5b189aae1d

SHA512
c6f50a9b15430d87d7f4bb324c60c379299c7dc2ddf1e959bec7dae5759fa9b052df20fcc4ea3587d4a93ef9bd0129c3b269ace1d2fd943d0e9b39c6da998fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44262.exe

Filesize
468KB

MD5
3953fb392d3b9523fd0a810567b66ccf

SHA1
e2fe205982c3922804b75e0eebd5da8dfbb85a2f

SHA256
675acbcfa302f8f1c6eb1bf1f01aede57299f73d2c5ffd3f68d7486eb8e5b7ac

SHA512
feec075a48b5c4331fd6687ce78a1cfc7c9cfb03e72172259947e5691feb7b25c646dad9413e18333dbd8897a9f128f19f5bd70a5198a98e851829d8248dce19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe

Filesize
468KB

MD5
ceffbee7dcc4571ac187514d1054e932

SHA1
790e368f8cd1b038ccabd66f5dff10c815697531

SHA256
2f46c6d2ee8408368e065f41643f756ed52649856593cab55620db2b56fd2d76

SHA512
fbbdcce46cadfaaa7794caa46621bb650fba5fefd2da4c13f9a44d3c5de1916b6257e829a2f944537ebb77ff1aa85f38ddb17d1015f3d65bbd365ea12e7fbbb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48611.exe

Filesize
468KB

MD5
1b2aaa9c72e27b60dca310a6fb7f6dee

SHA1
10b51916a6499c90bb9e7533a82d1578a366b6a4

SHA256
cf3c7f1aee5503daa7fc91c72ca03b6c4ba51ff165f02b7fba1224f7266dd133

SHA512
03c9e150409f219be0ad5eaf801360280f0cf7fdc934d3d8814c2c0afa4c5a21f47bcd0f3e873236afd32c48eca11a8bd48362c1f12260c513ca6b887eec9fcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49113.exe

Filesize
468KB

MD5
dfd67c7f292e58c31c69d93f81f6d7f0

SHA1
606a1432761f0c824638443a7f618a21db72724c

SHA256
bc884ec118ba8cfc69bc09d8aa851b3e3ef59a0daff5e6e88c838916623356da

SHA512
6bd426122dca58ee22378afc87bb6395496a626223d246ee805cdc651f9d46880474a7bd455a16b0ef492519db2b5cf49084b19637e6415c75b502e032f82bf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe

Filesize
468KB

MD5
e896aae6ec221217f7c3a6dd52f38adc

SHA1
4da7ee3d457b94e395fb1e6038933e240e84567b

SHA256
0c1be953bc36328a54539c65beaa7079aecf3230293a59ed415a693e4349f569

SHA512
d123c73f38b03bd583b3264f4207decdfa4077fb1e2c67e4ccefe977eb62e839e54f798cf29d63a305cba0c1f52f8c637b329465a02afccebfdeccae03347cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53551.exe

Filesize
468KB

MD5
b09af2a8d0d5ce76ad0dbaf3b76994f4

SHA1
f17849c7471d4e2aa063cf9b7b86bf720efe87b6

SHA256
ad00f8052191543b07e4a367b0d6b0792eb29b540652bcfa7318d564ee969554

SHA512
1ce343157cd5c462d03b4342e58e0e7569a27b86b7733b72a87b1bee33f379a3aeb709ed558c7af990d2462ec5a0dfc4849dc4e1eabf72b894e2feb8594f392b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57635.exe

Filesize
468KB

MD5
fd883118b8c2b7ce636e75f171700d76

SHA1
546d7d51748446c9f0b925af342f13b5fff10680

SHA256
5d953b1026991de156017626a70a26a64dc0e1d7dd434fb990f05209f9661494

SHA512
44d4c3271f74f7b233fcafbf565712c0abb722946896a8fb5c98887a5f5e5e201c72851ae31266b0663b9e42f9207ac270748667c560c6186ea6716db52393da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe

Filesize
468KB

MD5
e02ccb6d5682b15e7fbee6607972e296

SHA1
ba7af8c6c294e087b6645d0cab4e98ed9d93ad1c

SHA256
7b0c6b9d97225bb767190df3234698b04859986c584d50d2868d37321c1540e7

SHA512
5a0e0e9ea6a755c5152cd87e590277fb37c4e4e803a3fdf3c27647e1387b44ca20a2f9b27815708637bbca38d78399439c6bb64edb4b1493e84892e3cbd87b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe

Filesize
468KB

MD5
a6aaf022d77a7a3c9bcc4aac3c37290d

SHA1
24a31489acc1335d0c7bd871bdfb2a6354653164

SHA256
932c61f528c6eab3d08b307fa9dc424b833fa76e1bf82d8985fda3f62e4306c0

SHA512
f9fd4f4965a806de3c2014d32e9e27340fb2671ac63c1b93b40005fda990bf41de7052cb1e18d13c9a5029d5e69677463c6e151a28e79da587cfb8d4cf8fcaa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63172.exe

Filesize
468KB

MD5
c2ced032d65fd90adfdc3f6b471b4296

SHA1
6d15eeb8093d870341823ebe6f32e2199c46c554

SHA256
8c60b5d9f336d82ab12f50e719363138f83420b055d841ef2ed2a6bbec7ae34d

SHA512
db657cc4f86cb95cca4a04527902b92cd853e3b7f0eea07aae18500baf4e6a18a1d3d235755cb38e62a76ea7babb9dd46b6718c843d875a1deeea2c37c20f8bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe

Filesize
468KB

MD5
f9a0dd49222c25530f6f0edd1eca4964

SHA1
010f60902a23f89aa9a976996c071efa0ca7ee61

SHA256
3831840eee55747e0ee45deabe92095d7d8c96689d4392c03717f14be133ce9c

SHA512
c2f8bcad8be1d306747f48e8f6b04c605ecd1f9886c5462ebf97c18ecae145e48bed33acfdfc5ee92d2eb0ce17c8cd6aa3850f7178e26bc3e7dbb2c4556877cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65206.exe

Filesize
468KB

MD5
cadb0ac5de57ae158a016c6f7d188562

SHA1
0b8df919c8bcd0faf9fe8f0baff8b79374334cf4

SHA256
31ea4ec0a5b99918ad950957755cd7a04ed173e21b28ec799441dd5ae8cac31e

SHA512
cb530d5454370811d5d2fc6997328e688919faadf02d0be00db4960c8bb921b5b3352b788192926717d024734038d923f2186998f2bd9e3d6542e86b4d129de3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads