1bbe831c8366e1a7551213e0ddca8ddd3e3b96b0e95ba067a9ddb08b2c7bbd98

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd9d1d46497c493d59cd89c9ab542c30N.exe
Size

468KB
MD5

dd9d1d46497c493d59cd89c9ab542c30
SHA1

0f108e55b562c9781830e0ee5232c3bbc4de2274
SHA256

1bbe831c8366e1a7551213e0ddca8ddd3e3b96b0e95ba067a9ddb08b2c7bbd98
SHA512

33cbf46110e931fdb2aaff231aaf45deeff2b4e23acb51e3a4a9b4030caf443fb5af7479989b3fd89f2b3a35469458ed76e6ec5a6867a8cf9165caaa58da70a7
SSDEEP

3072:tqDrowLNpq8o6bxOPfzzo5f5/lgAoIpOxmHeAVsSqpfX52wZTLlq:tq3o+To6kf/o5fu0mcqp/cwZT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2060	Unicorn-62409.exe
1788	Unicorn-50873.exe
4960	Unicorn-22839.exe
220	Unicorn-35217.exe
4620	Unicorn-4582.exe
1288	Unicorn-19073.exe
4388	Unicorn-49944.exe
4784	Unicorn-5336.exe
3092	Unicorn-18335.exe
4812	Unicorn-21865.exe
4352	Unicorn-61361.exe
3944	Unicorn-53193.exe
1940	Unicorn-36592.exe
3036	Unicorn-16991.exe
2664	Unicorn-22558.exe
3180	Unicorn-45897.exe
3960	Unicorn-27951.exe
2412	Unicorn-23313.exe
3448	Unicorn-9206.exe
528	Unicorn-64537.exe
4336	Unicorn-64537.exe
2772	Unicorn-39463.exe
1704	Unicorn-28527.exe
5036	Unicorn-32057.exe
5048	Unicorn-47049.exe
2588	Unicorn-30713.exe
3100	Unicorn-52264.exe
2720	Unicorn-52264.exe
1864	Unicorn-6327.exe
3404	Unicorn-462.exe
1892	Unicorn-13904.exe
5088	Unicorn-35071.exe
3696	Unicorn-19503.exe
1392	Unicorn-17169.exe
4460	Unicorn-17169.exe
5004	Unicorn-49265.exe
1608	Unicorn-29399.exe
448	Unicorn-43135.exe
4288	Unicorn-49457.exe
3212	Unicorn-49457.exe
4444	Unicorn-13255.exe
1636	Unicorn-33121.exe
996	Unicorn-54480.exe
1028	Unicorn-8543.exe
212	Unicorn-43209.exe
3652	Unicorn-37271.exe
4588	Unicorn-43401.exe
4540	Unicorn-37463.exe
1688	Unicorn-42441.exe
3304	Unicorn-26105.exe
4048	Unicorn-1600.exe
3008	Unicorn-50801.exe
64	Unicorn-26297.exe
4956	Unicorn-50032.exe
5020	Unicorn-9960.exe
4648	Unicorn-47464.exe
1964	Unicorn-53031.exe
1432	Unicorn-42560.exe
1456	Unicorn-22959.exe
4196	Unicorn-17558.exe
2712	Unicorn-8336.exe
3064	Unicorn-37671.exe
1260	Unicorn-57537.exe
4928	Unicorn-26902.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
6524	5024	WerFault.exe	171
11796	5308	WerFault.exe	289
15768	6552	WerFault.exe	290
15784	7220	WerFault.exe	292

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62111.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15556	dwm.exe
Token: SeChangeNotifyPrivilege	15556	dwm.exe
Token: 33	15556	dwm.exe
Token: SeIncBasePriorityPrivilege	15556	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1128	dd9d1d46497c493d59cd89c9ab542c30N.exe
2060	Unicorn-62409.exe
4960	Unicorn-22839.exe
1788	Unicorn-50873.exe
220	Unicorn-35217.exe
4620	Unicorn-4582.exe
4388	Unicorn-49944.exe
1288	Unicorn-19073.exe
4784	Unicorn-5336.exe
4812	Unicorn-21865.exe
3092	Unicorn-18335.exe
4352	Unicorn-61361.exe
3944	Unicorn-53193.exe
1940	Unicorn-36592.exe
3036	Unicorn-16991.exe
2664	Unicorn-22558.exe
3180	Unicorn-45897.exe
3960	Unicorn-27951.exe
2412	Unicorn-23313.exe
528	Unicorn-64537.exe
4336	Unicorn-64537.exe
3448	Unicorn-9206.exe
5036	Unicorn-32057.exe
5048	Unicorn-47049.exe
2772	Unicorn-39463.exe
2588	Unicorn-30713.exe
3100	Unicorn-52264.exe
1864	Unicorn-6327.exe
3404	Unicorn-462.exe
2720	Unicorn-52264.exe
1704	Unicorn-28527.exe
1892	Unicorn-13904.exe
5088	Unicorn-35071.exe
3696	Unicorn-19503.exe
4460	Unicorn-17169.exe
1392	Unicorn-17169.exe
5004	Unicorn-49265.exe
448	Unicorn-43135.exe
1608	Unicorn-29399.exe
4288	Unicorn-49457.exe
3212	Unicorn-49457.exe
1636	Unicorn-33121.exe
4444	Unicorn-13255.exe
1028	Unicorn-8543.exe
996	Unicorn-54480.exe
212	Unicorn-43209.exe
4540	Unicorn-37463.exe
3652	Unicorn-37271.exe
4588	Unicorn-43401.exe
1688	Unicorn-42441.exe
4048	Unicorn-1600.exe
3008	Unicorn-50801.exe
1432	Unicorn-42560.exe
64	Unicorn-26297.exe
1964	Unicorn-53031.exe
3304	Unicorn-26105.exe
4956	Unicorn-50032.exe
4648	Unicorn-47464.exe
5020	Unicorn-9960.exe
1456	Unicorn-22959.exe
4196	Unicorn-17558.exe
1260	Unicorn-57537.exe
3540	Unicorn-23713.exe
4928	Unicorn-26902.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2060	1128	dd9d1d46497c493d59cd89c9ab542c30N.exe	89
PID 1128 wrote to memory of 2060	1128	dd9d1d46497c493d59cd89c9ab542c30N.exe	89
PID 1128 wrote to memory of 2060	1128	dd9d1d46497c493d59cd89c9ab542c30N.exe	89
PID 2060 wrote to memory of 1788	2060	Unicorn-62409.exe	92
PID 2060 wrote to memory of 1788	2060	Unicorn-62409.exe	92
PID 2060 wrote to memory of 1788	2060	Unicorn-62409.exe	92
PID 1128 wrote to memory of 4960	1128	dd9d1d46497c493d59cd89c9ab542c30N.exe	93
PID 1128 wrote to memory of 4960	1128	dd9d1d46497c493d59cd89c9ab542c30N.exe	93
PID 1128 wrote to memory of 4960	1128	dd9d1d46497c493d59cd89c9ab542c30N.exe	93
PID 4960 wrote to memory of 220	4960	Unicorn-22839.exe	95
PID 4960 wrote to memory of 220	4960	Unicorn-22839.exe	95
PID 4960 wrote to memory of 220	4960	Unicorn-22839.exe	95
PID 1128 wrote to memory of 4620	1128	dd9d1d46497c493d59cd89c9ab542c30N.exe	96
PID 1128 wrote to memory of 4620	1128	dd9d1d46497c493d59cd89c9ab542c30N.exe	96
PID 1128 wrote to memory of 4620	1128	dd9d1d46497c493d59cd89c9ab542c30N.exe	96
PID 1788 wrote to memory of 1288	1788	Unicorn-50873.exe	97
PID 1788 wrote to memory of 1288	1788	Unicorn-50873.exe	97
PID 1788 wrote to memory of 1288	1788	Unicorn-50873.exe	97
PID 2060 wrote to memory of 4388	2060	Unicorn-62409.exe	98
PID 2060 wrote to memory of 4388	2060	Unicorn-62409.exe	98
PID 2060 wrote to memory of 4388	2060	Unicorn-62409.exe	98
PID 220 wrote to memory of 4784	220	Unicorn-35217.exe	101
PID 220 wrote to memory of 4784	220	Unicorn-35217.exe	101
PID 220 wrote to memory of 4784	220	Unicorn-35217.exe	101
PID 4960 wrote to memory of 3092	4960	Unicorn-22839.exe	102
PID 4960 wrote to memory of 3092	4960	Unicorn-22839.exe	102
PID 4960 wrote to memory of 3092	4960	Unicorn-22839.exe	102
PID 4620 wrote to memory of 4812	4620	Unicorn-4582.exe	103
PID 4620 wrote to memory of 4812	4620	Unicorn-4582.exe	103
PID 4620 wrote to memory of 4812	4620	Unicorn-4582.exe	103
PID 1288 wrote to memory of 4352	1288	Unicorn-19073.exe	104
PID 1288 wrote to memory of 4352	1288	Unicorn-19073.exe	104
PID 1288 wrote to memory of 4352	1288	Unicorn-19073.exe	104
PID 4388 wrote to memory of 3944	4388	Unicorn-49944.exe	105
PID 4388 wrote to memory of 3944	4388	Unicorn-49944.exe	105
PID 4388 wrote to memory of 3944	4388	Unicorn-49944.exe	105
PID 1128 wrote to memory of 1940	1128	dd9d1d46497c493d59cd89c9ab542c30N.exe	106
PID 1128 wrote to memory of 1940	1128	dd9d1d46497c493d59cd89c9ab542c30N.exe	106
PID 1128 wrote to memory of 1940	1128	dd9d1d46497c493d59cd89c9ab542c30N.exe	106
PID 1788 wrote to memory of 3036	1788	Unicorn-50873.exe	107
PID 1788 wrote to memory of 3036	1788	Unicorn-50873.exe	107
PID 1788 wrote to memory of 3036	1788	Unicorn-50873.exe	107
PID 2060 wrote to memory of 2664	2060	Unicorn-62409.exe	108
PID 2060 wrote to memory of 2664	2060	Unicorn-62409.exe	108
PID 2060 wrote to memory of 2664	2060	Unicorn-62409.exe	108
PID 4784 wrote to memory of 3180	4784	Unicorn-5336.exe	109
PID 4784 wrote to memory of 3180	4784	Unicorn-5336.exe	109
PID 4784 wrote to memory of 3180	4784	Unicorn-5336.exe	109
PID 220 wrote to memory of 3960	220	Unicorn-35217.exe	110
PID 220 wrote to memory of 3960	220	Unicorn-35217.exe	110
PID 220 wrote to memory of 3960	220	Unicorn-35217.exe	110
PID 3092 wrote to memory of 2412	3092	Unicorn-18335.exe	111
PID 3092 wrote to memory of 2412	3092	Unicorn-18335.exe	111
PID 3092 wrote to memory of 2412	3092	Unicorn-18335.exe	111
PID 4960 wrote to memory of 3448	4960	Unicorn-22839.exe	112
PID 4960 wrote to memory of 3448	4960	Unicorn-22839.exe	112
PID 4960 wrote to memory of 3448	4960	Unicorn-22839.exe	112
PID 1940 wrote to memory of 528	1940	Unicorn-36592.exe	113
PID 1940 wrote to memory of 528	1940	Unicorn-36592.exe	113
PID 1940 wrote to memory of 528	1940	Unicorn-36592.exe	113
PID 4352 wrote to memory of 4336	4352	Unicorn-61361.exe	114
PID 4352 wrote to memory of 4336	4352	Unicorn-61361.exe	114
PID 4352 wrote to memory of 4336	4352	Unicorn-61361.exe	114
PID 1128 wrote to memory of 2772	1128	dd9d1d46497c493d59cd89c9ab542c30N.exe	115

C:\Users\Admin\AppData\Local\Temp\dd9d1d46497c493d59cd89c9ab542c30N.exe
"C:\Users\Admin\AppData\Local\Temp\dd9d1d46497c493d59cd89c9ab542c30N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61361.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49265.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        8⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21217.exe
        9⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51505.exe
        10⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20326.exe
        10⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        10⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        9⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        9⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        9⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
        8⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12008.exe
        9⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36073.exe
        10⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50288.exe
        10⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5719.exe
        9⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3806.exe
        9⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35680.exe
        9⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        8⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        8⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        8⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55071.exe
        7⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        8⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        8⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        8⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20399.exe
        7⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        7⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54752.exe
        7⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        7⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54377.exe
        8⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        9⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        9⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
        9⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        8⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        8⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45273.exe
        8⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20489.exe
        9⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19511.exe
        9⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
        9⤵
        
        PID:17288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
        8⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        8⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11455.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19054.exe
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        7⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
        7⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        7⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2344.exe
        8⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28302.exe
        8⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10826.exe
        8⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13918.exe
        7⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24703.exe
        7⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49903.exe
        6⤵
        
        PID:9708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
        6⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63457.exe
        6⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7254.exe
        6⤵
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28527.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45273.exe
        8⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        8⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        8⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11846.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34640.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32246.exe
        7⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25499.exe
        7⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        7⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        7⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50315.exe
        7⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        7⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20399.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        6⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7627.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
        6⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9208.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exe
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        8⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
        8⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29046.exe
        8⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58656.exe
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
        7⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56267.exe
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56232.exe
        6⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18097.exe
        7⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        7⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exe
        7⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50487.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32824.exe
        6⤵
        
        PID:14044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6326.exe
        6⤵
        
        PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28736.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
        6⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
        7⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12763.exe
        7⤵
        
        PID:17356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        6⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56127.exe
        6⤵
        
        PID:332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-686.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
        5⤵
        
        PID:15032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        5⤵
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25655.exe
        5⤵
        
        PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30713.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42441.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42841.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        8⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        9⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        9⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        9⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        8⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        8⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        8⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37730.exe
        8⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12823.exe
        8⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8518.exe
        8⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
        8⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19054.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
        7⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
        7⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
        7⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56321.exe
        8⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16975.exe
        8⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        8⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36943.exe
        7⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26958.exe
        7⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11550.exe
        6⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65200.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        6⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8971.exe
        6⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
        7⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        8⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        8⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27327.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        7⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        7⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32530.exe
        7⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exe
        6⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44993.exe
        7⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7220 -s 600
        7⤵
        Program crash
        
        PID:15784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56127.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        5⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21329.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12934.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        6⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39739.exe
        6⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
        5⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
        5⤵
        
        PID:12148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14448.exe
        5⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62423.exe
        5⤵
        
        PID:17184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1600.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9208.exe
        6⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11936.exe
        8⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53960.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44071.exe
        7⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
        7⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
        7⤵
        
        PID:16776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        6⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44993.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32359.exe
        7⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        7⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33600.exe
        6⤵
        
        PID:14956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
        6⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9327.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        6⤵
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        6⤵
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        6⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36351.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
        5⤵
        
        PID:15132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31939.exe
        5⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48437.exe
        5⤵
        
        PID:9372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42560.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26913.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48480.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46972.exe
        6⤵
        
        PID:17300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
        5⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54213.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57839.exe
      4⤵
      PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63513.exe
        5⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        6⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        6⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10799.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        5⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        5⤵
        
        PID:17276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
      4⤵
      PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60544.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36447.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exe
      4⤵
      PID:14264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19755.exe
      4⤵
      PID:11228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29089.exe
        7⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 648
        8⤵
        Program crash
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28463.exe
        7⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        8⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40519.exe
        8⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
        8⤵
        
        PID:17284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        7⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        7⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
        7⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55840.exe
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63384.exe
        8⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33246.exe
        8⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30060.exe
        8⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57504.exe
        7⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        7⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5006.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26962.exe
        7⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61808.exe
        7⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
        6⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4947.exe
        6⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54480.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45425.exe
        6⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25289.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        8⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        8⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8687.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48012.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        7⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        6⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        7⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        7⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49904.exe
        7⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2631.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63663.exe
        6⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9251.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56605.exe
        6⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11624.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        6⤵
        
        PID:15080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
        6⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49599.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
        5⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32414.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57792.exe
        5⤵
        
        PID:15068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6472.exe
        5⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12646.exe
        5⤵
        
        PID:10044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43209.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37257.exe
        6⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
        8⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45415.exe
        8⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exe
        7⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20815.exe
        7⤵
        
        PID:14152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60211.exe
        7⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
        7⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        7⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18877.exe
        7⤵
        
        PID:14640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        6⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15610.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48667.exe
        6⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55840.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12808.exe
        7⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58624.exe
        7⤵
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe
        7⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7550.exe
        6⤵
        
        PID:13840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
        6⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33942.exe
        5⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9040.exe
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        6⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        6⤵
        
        PID:11644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        5⤵
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        5⤵
        
        PID:13992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39230.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        5⤵
        
        PID:16980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45273.exe
        7⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        7⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        7⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        6⤵
        
        PID:12956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        6⤵
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        5⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        6⤵
        
        PID:12808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        6⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19054.exe
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
        5⤵
        
        PID:13848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37154.exe
        5⤵
        
        PID:16504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27008.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64281.exe
        5⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
        6⤵
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51552.exe
        5⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
        5⤵
        
        PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24852.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31334.exe
      4⤵
      PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        5⤵
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        5⤵
        
        PID:9164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
      4⤵
      PID:10764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64193.exe
      4⤵
      PID:14724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54638.exe
      4⤵
      PID:11664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22558.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23713.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32591.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        7⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        7⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
        7⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
        7⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        6⤵
        
        PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12600.exe
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        6⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        6⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11654.exe
        5⤵
        
        PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        5⤵
        
        PID:11320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48583.exe
        5⤵
        
        PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58615.exe
      4⤵
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13624.exe
        5⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45833.exe
        6⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29024.exe
        6⤵
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
        6⤵
        
        PID:16764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44151.exe
        5⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13918.exe
        5⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28787.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5679.exe
      4⤵
      PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        5⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        5⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41462.exe
        5⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
        5⤵
        
        PID:9340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
      4⤵
      PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35967.exe
      4⤵
      PID:10540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6472.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
      4⤵
      PID:16524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26297.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:64
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27961.exe
        6⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
        6⤵
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
        6⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33063.exe
        6⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9055.exe
        5⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        5⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        5⤵
        
        PID:15296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50168.exe
      4⤵
      PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        5⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-547.exe
        5⤵
        
        PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
      4⤵
      PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        5⤵
        
        PID:13600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
        5⤵
        
        PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
      4⤵
      PID:11360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48583.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
      4⤵
      PID:7372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17558.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39009.exe
        5⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58049.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
        6⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        5⤵
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        5⤵
        
        PID:16000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exe
      4⤵
      PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
        5⤵
        
        PID:9652
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 636
        5⤵
        Program crash
        
        PID:11796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18006.exe
      4⤵
      PID:9716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
      4⤵
      PID:14104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
      4⤵
      PID:8288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
    3⤵
    PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
      4⤵
      PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
      4⤵
      PID:12196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7782.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22468.exe
      4⤵
      PID:17208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
    3⤵
    PID:8028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exe
    3⤵
    PID:10688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48567.exe
    3⤵
    PID:14768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47011.exe
    3⤵
    PID:1948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22839.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22839.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35217.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5336.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8336.exe
        7⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
        8⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59865.exe
        9⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36663.exe
        9⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        9⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        9⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28254.exe
        9⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        8⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        9⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        9⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
        8⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4022.exe
        8⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        8⤵
        
        PID:17156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
        8⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
        8⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33054.exe
        8⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54564.exe
        8⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41343.exe
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        7⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33475.exe
        7⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3320.exe
        7⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        6⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27273.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38377.exe
        9⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
        9⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        8⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49222.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe
        8⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24815.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
        8⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45192.exe
        8⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
        7⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28247.exe
        7⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2688.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2078.exe
        7⤵
        
        PID:15136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
        7⤵
        
        PID:228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17519.exe
        6⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34817.exe
        7⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        7⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49005.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28250.exe
        6⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35071.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57537.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51512.exe
        7⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        8⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        8⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3205.exe
        8⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        8⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
        7⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40766.exe
        7⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        7⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41567.exe
        7⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41223.exe
        7⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
        7⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20399.exe
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        6⤵
        
        PID:9908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11048.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe
        8⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        8⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        7⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33174.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12150.exe
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
        6⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36240.exe
        5⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        6⤵
        
        PID:12768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20330.exe
        6⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44791.exe
        5⤵
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        5⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24692.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31950.exe
        5⤵
        
        PID:9076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17169.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1704.exe
        6⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60137.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exe
        8⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        8⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13918.exe
        8⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57568.exe
        8⤵
        
        PID:16512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
        7⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61168.exe
        7⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        7⤵
        
        PID:14068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24703.exe
        7⤵
        
        PID:16740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50168.exe
        6⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7639.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        7⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3339.exe
        7⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        6⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16636.exe
        6⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14703.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62249.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50353.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe
        8⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16718.exe
        8⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58264.exe
        8⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        7⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        7⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exe
        7⤵
        
        PID:16732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33174.exe
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        6⤵
        
        PID:14192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22318.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        6⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12008.exe
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11774.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
        6⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29370.exe
        6⤵
        
        PID:10264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9638.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        5⤵
        
        PID:14652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39384.exe
        5⤵
        
        PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43135.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
        5⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
        7⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24359.exe
        7⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        7⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57140.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46091.exe
        7⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31744.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11574.exe
        6⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46851.exe
        6⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        6⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52409.exe
        7⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        7⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46752.exe
        6⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3806.exe
        6⤵
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        6⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe
        6⤵
        
        PID:10336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10135.exe
        5⤵
        
        PID:11448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
        6⤵
        
        PID:12976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
        6⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        5⤵
        
        PID:13320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        5⤵
        
        PID:8484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
      4⤵
      PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35393.exe
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52376.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        5⤵
        
        PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63440.exe
      4⤵
      PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40833.exe
      4⤵
      PID:13728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44749.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
      4⤵
      PID:9880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18335.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17169.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59073.exe
        6⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65264.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        8⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        8⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        8⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
        7⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
        8⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
        8⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        7⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39038.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe
        7⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18410.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41196.exe
        7⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        6⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57903.exe
        6⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28977.exe
        6⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63513.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        7⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        7⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13478.exe
        7⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        6⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58956.exe
        6⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43823.exe
        6⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1359.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12823.exe
        6⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8518.exe
        6⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        6⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30966.exe
        5⤵
        
        PID:9836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23767.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        5⤵
        
        PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
        5⤵
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29769.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12008.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
        8⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13502.exe
        7⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47280.exe
        7⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25478.exe
        7⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        6⤵
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8211.exe
        6⤵
        
        PID:16236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        6⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
        6⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3486.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        5⤵
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38607.exe
        5⤵
        
        PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
        5⤵
        
        PID:16788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61215.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30841.exe
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe
        6⤵
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
        6⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        5⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        5⤵
        
        PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17695.exe
      4⤵
      PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        5⤵
        
        PID:17236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30966.exe
      4⤵
      PID:10084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
      4⤵
      PID:14320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
      4⤵
      PID:15564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
      4⤵
      PID:1572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9206.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49457.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
        5⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14880.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exe
        7⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        7⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        7⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59232.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25044.exe
        6⤵
        
        PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16718.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        6⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41360.exe
        5⤵
        
        PID:10556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        5⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        5⤵
        
        PID:16248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        5⤵
        
        PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31335.exe
      4⤵
      PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27961.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
        5⤵
        
        PID:15916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        5⤵
        
        PID:10304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
      4⤵
      PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
      4⤵
      PID:11004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
      4⤵
      PID:14916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64996.exe
      4⤵
      PID:5140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37257.exe
      4⤵
      PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        5⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37105.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        6⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        6⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59232.exe
        5⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55000.exe
        6⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64000.exe
        5⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
        5⤵
        
        PID:7260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52968.exe
      4⤵
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15200.exe
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29367.exe
        5⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
        5⤵
        
        PID:9620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28984.exe
      4⤵
      PID:14112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
      4⤵
      PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
    3⤵
    PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
      4⤵
      PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31537.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        5⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18877.exe
        5⤵
        
        PID:14348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
      4⤵
      PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7166.exe
      4⤵
      PID:12524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
      4⤵
      PID:4084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57752.exe
    3⤵
    PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53177.exe
      4⤵
      PID:13440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
      4⤵
      PID:16800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
    3⤵
    PID:10884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60918.exe
    3⤵
    PID:14824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21865.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47049.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe
        6⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        8⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        8⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
        8⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        7⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64792.exe
        7⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56808.exe
        6⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42807.exe
        6⤵
        
        PID:13636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        6⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51505.exe
        6⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39529.exe
        7⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62959.exe
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
        6⤵
        
        PID:14360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        6⤵
        
        PID:10000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        5⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe
        5⤵
        
        PID:10256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42615.exe
        5⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        5⤵
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22959.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
        6⤵
        
        PID:732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16191.exe
        6⤵
        
        PID:11288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        6⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        6⤵
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        5⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53108.exe
        6⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        6⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17342.exe
        5⤵
        
        PID:11100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17455.exe
        5⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46091.exe
        5⤵
        
        PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19025.exe
        5⤵
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe
        5⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39539.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
      4⤵
      PID:8280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10790.exe
      4⤵
      PID:11340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47999.exe
      4⤵
      PID:15024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39384.exe
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43401.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
        6⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50315.exe
        7⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59232.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        6⤵
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32060.exe
        6⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2790.exe
        6⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12823.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9478.exe
        6⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        6⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        6⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10118.exe
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4287.exe
        5⤵
        
        PID:14212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        5⤵
        
        PID:16828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31033.exe
        5⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        6⤵
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
        6⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
        6⤵
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43663.exe
        5⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        5⤵
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        5⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3750.exe
        5⤵
        
        PID:16412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19998.exe
      4⤵
      PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        5⤵
        
        PID:12848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        5⤵
        
        PID:17240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
      4⤵
      PID:9688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24158.exe
      4⤵
      PID:14076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
      4⤵
      PID:7376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
        6⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20518.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24162.exe
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48859.exe
        6⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42983.exe
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55303.exe
        5⤵
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
        5⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40507.exe
        5⤵
        
        PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
      4⤵
      PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe
        5⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
        5⤵
        
        PID:9628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
      4⤵
      PID:10056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
      4⤵
      PID:13800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
      4⤵
      PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
    3⤵
    PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
      4⤵
      PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
      4⤵
      PID:11816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13918.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33063.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50743.exe
    3⤵
    PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
      4⤵
      PID:10664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32887.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6367.exe
    3⤵
    PID:11140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25465.exe
    3⤵
    PID:14972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42951.exe
    3⤵
    PID:16404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49457.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
        5⤵
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44865.exe
        6⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12008.exe
        7⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16097.exe
        8⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
        7⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4958.exe
        7⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25044.exe
        7⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-799.exe
        6⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21094.exe
        6⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33475.exe
        6⤵
        
        PID:13932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29607.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        6⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
        6⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7430.exe
        5⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
        5⤵
        
        PID:12868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
        5⤵
        
        PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        6⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        6⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        6⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30710.exe
        5⤵
        
        PID:12564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        5⤵
        
        PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20278.exe
        5⤵
        
        PID:10320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11830.exe
      4⤵
      PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60784.exe
        5⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3205.exe
        5⤵
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        5⤵
        
        PID:9208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47992.exe
      4⤵
      PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32134.exe
      4⤵
      PID:14012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2311.exe
      4⤵
      PID:16808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60535.exe
    3⤵
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27657.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60633.exe
        5⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59584.exe
        6⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36447.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53960.exe
        5⤵
        
        PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
        5⤵
        
        PID:14984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59800.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8671.exe
      4⤵
      PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2542.exe
      4⤵
      PID:10492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
      4⤵
      PID:14924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
      4⤵
      PID:16220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63712.exe
    3⤵
    PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
      4⤵
      PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45599.exe
      4⤵
      PID:12232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
      4⤵
      PID:15656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
      4⤵
      PID:10452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
    3⤵
    PID:8336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27919.exe
      4⤵
      PID:12860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
      4⤵
      PID:7628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17607.exe
    3⤵
    PID:11400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32777.exe
    3⤵
    PID:15316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54638.exe
    3⤵
    PID:9404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39463.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39463.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59177.exe
      4⤵
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55345.exe
        5⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        6⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17341.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7371.exe
        6⤵
        
        PID:416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35687.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50316.exe
        5⤵
        
        PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exe
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        5⤵
        
        PID:9072
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 652
        5⤵
        Program crash
        
        PID:15768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
      4⤵
      PID:860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
    3⤵
    PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
      4⤵
      PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      4⤵
      PID:10956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
      4⤵
      PID:15788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
      4⤵
      PID:17012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
    3⤵
    PID:6572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25886.exe
    3⤵
    PID:12208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26229.exe
    3⤵
    PID:6096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50032.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50032.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
    3⤵
    PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
      4⤵
      PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      4⤵
      PID:10980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52047.exe
      4⤵
      PID:14872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
      4⤵
      PID:9508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
    3⤵
    PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
      4⤵
      PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
      4⤵
      PID:14996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
      4⤵
      PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52488.exe
      4⤵
      PID:8208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36367.exe
    3⤵
    PID:11508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64264.exe
    3⤵
    PID:14568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
    3⤵
    PID:3420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exe
  2⤵
  PID:5832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21329.exe
    3⤵
    PID:6388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
    3⤵
    PID:11176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
    3⤵
    PID:15920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17886.exe
    3⤵
    PID:17196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45990.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45990.exe
  2⤵
  PID:8076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41247.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41247.exe
  2⤵
  PID:9928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
  2⤵
  PID:14796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7430.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7430.exe
  2⤵
  PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5024 -ip 5024
1⤵
PID:6248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5308 -ip 5308
1⤵
PID:11784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7220 -ip 7220
1⤵
PID:14692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6552 -ip 6552
1⤵
PID:15596

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe

Filesize
468KB

MD5
42662ca18a7eef4bcca0029514f77157

SHA1
e2bc364cce15e78c0685f70c199800f78aaf41fe

SHA256
ce34fdf1df69e3a565e4c873722cc50439c8dbf35ebb88cd080308515fcdd09c

SHA512
fe4387157fb33d0c54af0c3ed9dfdab9655364fdfb6c0ecf0de02ad05f8640e949d02f8a0bbc527a73dc5e9b1d1e85fb7d945da9d71b92c66a58e7a9b79eb7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe

Filesize
468KB

MD5
0304d43057cf7662391e8039bc16736f

SHA1
ff473af3a17da51223043190138be7136f0ecab1

SHA256
71f2f95cc8e5876d42e744815c6fba41e78b7cc1a8a2c4abc2dd98e4d244e183

SHA512
6f4560d7570d3e2e25cb99a2c2d374cc75ae1ba425a198b62ad9c863dc43b6e1464f92f8a5d9e8bdeb51bd86840951dcda5458833943de6e0dcbdcea42876615

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18335.exe

Filesize
468KB

MD5
a1d0864167c55abc610bcb05eedbd5db

SHA1
d13aecfdb706a83c43ab2037f97af0ae9d6b4690

SHA256
dbe3f3dd9ee068990f4f56b5403dd6e7ce3db79b09a0c5bf8a3346be7c18ac97

SHA512
d2157f87c512d2038fc1c13cab6a2abede3815b35078725b9cb74a96f24dd4cee80d01cd30864890ebb15ccc5701abf2d956461875408c2415c6e1e3e7939ac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe

Filesize
468KB

MD5
d59400abf61de776f5969bf72513028b

SHA1
67da64efa063547eca8c2b6a3e47bd992d7b9a4d

SHA256
a133a7a7703aa91c5b1320263a332efe19e176999fd981d773b32dd579ebd853

SHA512
d304b8d2098983fe5efa9465cf05b8ec9cacda51e472a16853ba63e2384e8bb4b9a268188e54e49e7c77131fde82d484eac669ad5bb8b3a64716af8f72441344

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe

Filesize
468KB

MD5
b3d118055321820bc568b113594730f4

SHA1
a2f87330576c9d4d8e664ce0857c313164cbfead

SHA256
3122b3c74b533a762bc0f1e68cd65a9f86dba3742fe3d6d09b27daa543a31a40

SHA512
33f312482d209caf08978662990aee11965fb0dea79685c479b32ba4b1860391d4ca14aac568bfd280234d394e4021bc15098b3c9714a4fabde0b8a564a3644c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21865.exe

Filesize
468KB

MD5
c4730d157a783d126a0dc8c862c05a69

SHA1
1e42336d58377dfe8b757146d13c20615c72c059

SHA256
2d84848bd9e8bda9c3e337c8cacdc526459647aa57895130569d106eecea7747

SHA512
5c7fd3e6fc6d5f47135777243630073f3caa786e78e7ccf2705ccaa7511f74edd26a6898c97b03cff4e19b93d1e1f904ac5aabb5f40f193f236ccba2e4e6c862

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22558.exe

Filesize
468KB

MD5
7fc5e7301d61ea4b0f4c9a7cbaa49a23

SHA1
6bc2b847d98af5f40c2f9f69e8c50a597c043ae1

SHA256
306e5c2ae518a06bb1f1699778321f94ff313944dd801c52651abff3e9e7c660

SHA512
838f110e9125dfa13e319056dc22e90a65c61b5755ab3383ab227efd7b8db454f7acc4bb9022e587c9f6f4e5cb75a8f8ac342c724960f29594d27dc7614fb79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22839.exe

Filesize
468KB

MD5
aec69fb7302419b11381b874aa7347b9

SHA1
76b317648f3c3ebf1dffb63784101c0dd7baa1b0

SHA256
4fecc86f77bf702502c084e7a7adcdd361483a01038434e4539812627a4f0dca

SHA512
7c62cf70a44a123243cfe43da49844fbf5d61b8748a2dc3642d108064eb47e52492bd498b645cb1e21b05c22e7f8bf452a1b803edf9ca2741921b27e00a50157

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe

Filesize
468KB

MD5
cf7c99fa440db4321e9f537744f9564b

SHA1
2a2887ed06a91546f2b379e0d6f6ee7bc69b9026

SHA256
e0750d9356a325f0aa231045384e890d0b43b47f26150c0470aa340060e459eb

SHA512
016d6b25110701188200a8489b190e74e8514cf372d4b55b61c766d4f8bf09de0f3d6c02c687fdd78483fcf5aadcad2e437bc2666a157f61e775676812693049

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe

Filesize
468KB

MD5
0c430990947a15d1f55abac30407440e

SHA1
d964c3225b28d9f3605a80cdb374ea5fa9b07880

SHA256
eeb9fee1e7ab69841cfd8862db38aa68850977dec63f62ee093785219e72d90f

SHA512
903c6450a030fa9ddfcd39af16e8ab755c00d6b05e248b235d2609d995bac99cf67d11ad6f8d078a3ad9e1a6c5828470084f8491a172be6a1402b5e46180690f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe

Filesize
468KB

MD5
756ab906e53ca720c243c3c1f4102b9c

SHA1
1dd1482d26e6d3772f1e5721d438a8a22c492f64

SHA256
bd8fca7d2ad6dc487f4c5498343b423d0bd19944b79a5bdee903d91b846f26b0

SHA512
6734548d8e3baf37610bbc11876d7416fbd18eb220846831f5304e10f43a4830c8d2337c05c3380bce01f286fdf1f68423b0ab6b5943ac21becf961c74e29389

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28527.exe

Filesize
468KB

MD5
0b7c50e0cc7055cbdb345446e3d37959

SHA1
69dbd4327dd7bc155d8f766ca02b0d2cf99f5cc4

SHA256
57fab183b93e63276f8788b0147f7fb0a862d62270a6effcc41b3562e6d959de

SHA512
85f0363bffa6938911191d85af52c413b9b91d063e4390ed03a77cfa7cb55909051e780f54153e6783f7f5f83c9a1b0942cdc7b165031f5ed5288ca5b8d5df7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30713.exe

Filesize
468KB

MD5
a5ce56a4e3abd4099084c84ad7922441

SHA1
10c541c82a532f06506f145dfd09642c175f7908

SHA256
6ccde3704dd67c52df191c5942fe2f32db590f89176b73be08b87338f2079cc4

SHA512
e4fe31a3942c27f4e4b3ef6a908cb9d1719220a94b463adb3a7e45c5ebc05c4f7d68dbc54c554a86e4bad2be11bdc095b9d4d4c98c5ea4a0b75f20b5048155a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3205.exe

Filesize
468KB

MD5
46a6e0f4e813f05ad74437f9a88f962d

SHA1
b4810110cccc60737e57309741a8769bebdae2e8

SHA256
c898c04b7c294f3db40f826b844dcbc47c16ba1dafb6ad2adb3755fdff87db09

SHA512
eacf372e9546655b34c8bbaee0f2b01915358fcc1f36402bf3aa369f8d334d4cab93219f49cb3213afb28437fb97294ebef5c02588d5fab7095268d8e86ef5f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe

Filesize
468KB

MD5
87bcdcc9b9fbe79f5c788199faab2bbd

SHA1
2bc5a624462033c26959e645ae1381548da40ff8

SHA256
5355ea710b787d6d895d051a1312e48dc872eb314a91c2f545621e0810aea15f

SHA512
467deecdcaaec06bdabd8cb1229fb956df538ae4cd28edfca4f2321f44cc8898423b1c1affccef09b5fce6e255045afdd170b5f1b4dc2a4a05e8052978f51c66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32359.exe

Filesize
468KB

MD5
92f5feb90e85332821f6019bd464bc64

SHA1
78f5fdb81772f64344fe3ce6fa7f0cb5472b35e2

SHA256
6ee898985052debc33fa566f7bd10ceea2d4ccb6d399bce71029f09a75f13fb0

SHA512
64cc62c2489964fd7a24b46f8d617dfdc31c28bc2a13cfd6d6de8d9658e66ff52f9e6e58b1517c473ab5b3ea2342d48b0f017531d66d942c982d006297e9e406

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35071.exe

Filesize
468KB

MD5
8e267c6717843c6382efcb7188a25cea

SHA1
91d9c40b7d7768a188afb57c4ad8a19712d68b68

SHA256
e47cc47bfadcc01774431cea52d8f0d73af921450ef9cc49979cd4848aa85925

SHA512
08d31a94e3739ffbb63e19f9b35107415990bfc62ca333631f416cddb07bde1d42737b0ab8a7bd8ab10250169c9b85fd3e8163bd957ad9be293c2717a5a134ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35217.exe

Filesize
468KB

MD5
37dbfae107def5d8bc5950ab958cbf82

SHA1
912abe42f385abb8c8fd6d7f8ae7ff07ce9b43bd

SHA256
61276e57dd83fb9ce938b1ecbeba489bc04cd283f121227e523db0ddee236989

SHA512
9706d5711d3c6cc126904e226c967d54e89bbc5d375a92378a31e6e018044ba3eb2ca247873cc7dd1cf059842987feb54c5507bc81c6fc27c6fd5339a861df55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe

Filesize
468KB

MD5
04ba29e3998fc2890df1039b21715555

SHA1
265cbd93b4c56d5e32442b277fd6fe1c9ca031fb

SHA256
5713aad6613a2ccfdf21405ec0679a6b9ba425b83f52c7e83949c4b6d806a7f8

SHA512
64c8123c92d2c337371f5a36befac435054bdfb37def9301ed40c002188c2e21cd7d3fff92c86fd7b94f8a3dfe6995b28fbbe0d159b17b7844ab4383f41b2024

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39463.exe

Filesize
468KB

MD5
b7c1e874317f4d5396f88f9592465e0e

SHA1
d66a9ed8a807499f6dda23c039a88700ec46ba09

SHA256
4450d17a35cacefb2031fc14981dab10f3f9d6e50afa77a1191190d3ecca9b8a

SHA512
7276efcf5fa25bfea162b809f1c547b456ff3dde1abfd7d25dca4b19ad076a5cae81ce0989fa070cb975322f3e66859104b9a5055b96bc60c407139c5c24dcb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe

Filesize
468KB

MD5
932ec5b0dde598cfaefc8d28103102e3

SHA1
752e4689794ea9edc323c1b901f7124b2d84fba5

SHA256
0518b880285813c128cd48922edf6f89ae30e0b88e8211dd70f328a69591a222

SHA512
4b68cf3b5b44cb6cd76fb487816f23213a25b09890d38f28b90a9b513f9c32f5f06f4e9f03d057f2b571e947bdcbc8591d48ad83edf4c4edd690a977499812ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe

Filesize
468KB

MD5
80fe2beb39bdc48be05f808b629e86c9

SHA1
3cf10ad32ce98518a59091cfa26635de83204326

SHA256
4fcb1fb9b193bb32a6596dc51ccb497eee7068273d09a6891afb2bf5f6e4f2e8

SHA512
41ca20b2b6d0a109eb13d8ef22f828e65cb1e7f208f8c4d716bfef896da2cf600121301ed0dfbb683be9a453db522e1dd4f9558d773d7d913fb0ee083c651c9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe

Filesize
468KB

MD5
aa47878f2aa545405c5b9fb18eb80c23

SHA1
35299d15b7acc2345e2e45a49c58e06cca8bc5e5

SHA256
23da7a731a205e20b73a9e768a4270352a4b233dc9f52411eefe5e55929c20d8

SHA512
986b1035bde6b809497d075e4cb26fd9fd63fa67db02edf880797ae379608c6ddca8351d5a72581ce5dfe1167604e35a3a8e02f0d954a3886e86a2c3f0dd8d3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47049.exe

Filesize
468KB

MD5
055f7d30e4e9036be76bc5055ee7bfcb

SHA1
9f417a8dc831fae95a9ff0cc9bfd01d318ca3bcf

SHA256
4d80d9b35c320785077950f707f3f361437ab1451d7114b652460ca53ea7a7d5

SHA512
14a1b021fc7d5bbdc09c7f4eed166e5df61646530e7eae140da53f6422f6fbcb17bfce1585a9d9b838dda057f843de43ace82a478b23095828e1c4898638a931

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe

Filesize
468KB

MD5
1551ceb23e2cc48b28de665d1ebdb0f3

SHA1
1f18c3ecf5db1e31e86c7db141398ca8bd0c7123

SHA256
201da26e67e59bfb4d5280f5822281e092819785ce60b3766e6e2ce21f7a2478

SHA512
44c3d67ab7f78b583425b00c735dbb7b735212bc0a34477ba8a6cde34b7a323656cd330adcd127d1063c469ff6e97744efd93842bc40c28c24bd1da6a401d421

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe

Filesize
468KB

MD5
0f9a385a85ab71084cbd1833ca6cb1ba

SHA1
98dc21b1dc69330f32244991860b0bea333302d3

SHA256
9d8041b25221c0f3eea36219901881b8d8582ba1f49759f3cc147112e8a13770

SHA512
e5094ccb63377028e4b723a50b07e8625aa171fdc9497e3a95b6e020aef0a4f06e567cc074ea0b4a0daf47cd07e81b55704caa6742f65f128291d77f2fa90a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe

Filesize
468KB

MD5
bc8628586fcef08768e6578aefa6c81e

SHA1
814e5ac17bb1f9c3750ebdb5090986e2c8559f4b

SHA256
6c19a1de3db242216ed3c6e31f0e8a87f1464d6de4a196072e0f84025b6c7693

SHA512
5c55701383347d7012bd0308c52b900d4fffc66eb2ec757ebba057cbf5d413fda166a22323b35b82fee86763c78897c7e15092756cb9d93bd00160a511c60aae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe

Filesize
1B

MD5
93b885adfe0da089cdf634904fd59f71

SHA1
5ba93c9db0cff93f52b521d7420e43f6eda2784f

SHA256
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

SHA512
b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exe

Filesize
468KB

MD5
dbd8565d906013b0b8cea17118cff7a9

SHA1
95a4458a3680ce7a4b019daea3c879eedd47fc7d

SHA256
81798e164bd06f15c699528b4552c12d88fabddfe808065446d0a133e941ffc9

SHA512
5a2d1fbfd30b14b46e2c3fe1a9b43e7c63e93fd982b0df143d599c9846eb11efe7f075ba0a18d62e1caa0e82a73f22ae53376745c6d97213adfa99e6b1de40c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5336.exe

Filesize
468KB

MD5
ff53818e7ed1fa3572a2b36750e385ab

SHA1
2a389040f214d640c1dad7f2a875dcd27842ed8d

SHA256
863885bf26e9fc3a3c351dfaa65a6c9d8ec133d5ef25e64d0fe7a177cd53780c

SHA512
5adb82c4c5e6f1d43cff70df5fbf02142bdbae7b2e9451a3a8004788834fa269f65ae5286d2b339a1bc91e9c0b70fb29db01f08cad8ac93e3a8fc93ab942f2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61361.exe

Filesize
468KB

MD5
4a6b9d583604721426883541d25a2b14

SHA1
7cadfebc22a95b6a7fe452e6f8dbe7a6b53a698d

SHA256
f9ce3d78fdf9cf0238e049e4aa351391615622a135d04dc38560a98c9939d75e

SHA512
bc697ebe1b24ea94a8d7aa77c869dd069342d346a4a1cc518e58fd50b25acd87c6a50099c81dbbc9b63d531885e9ae08d8669507617db0103c00df2d61dbf3e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe

Filesize
468KB

MD5
d1f7ebdac9fa2fd4ddce66c37441345c

SHA1
792c63baadc347d230351c01d24d857969173a99

SHA256
46b3a2966e64cc6584f0838e036afaec918dbbdf714423c50090a8c7afa960e5

SHA512
69e0cfd30237f55373940534badc34458e8a0b0d9feb8c2d443ede7f46c6cc176ac834b2a143beb277df627b91f7e1d3c2edd91165c23d6af0f65e78a78789ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe

Filesize
468KB

MD5
6ae1c555dcf4808a2d0e81dfe6f119b7

SHA1
a11da737bad2181f0ecaca31f445a9065c32fbde

SHA256
fef05ddf5679bd4af15b6f6d60739a98ffadc7efe8cba8c60c2e38fa382e9e31

SHA512
6bde80cf0c3a0c4ee356dd66eb8293a96f164920f149af45315a4b011b99895dedc44bac6fcb34b2fa358cc306c442d68ce394e18fcecb83f36e1df5cdefeba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe

Filesize
468KB

MD5
52318da23ff6d602665de9c285dc2c26

SHA1
b0c4d4d96b57f5428a674db071343654225b9f52

SHA256
849a3f7487e4e75b340ba45addc8589109d79c0d658b9ac27314b2236e59e473

SHA512
c80c0549b5d0bd79496c5837068c7b9a2957c1f7c49c6a0b6dd821255960082d324b404ce9b38925e24d2ec309c18e605bbd4f9ccdab0e958fd56e09d35d9ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9206.exe

Filesize
468KB

MD5
e3ca3f27cd966f345576ef100c48098c

SHA1
bf268b2ee3468ab393ff7e3949c1d947343f06d3

SHA256
98a14496f9fb9c721869d536849934e5c9fa31ab3226706c01f7da6c623003fa

SHA512
8597cbefd0f1aed6c40d34b033ecbbd40ef9237335391ccea03422ced36ccd90afab4b2385f3cab1aabf61d4d7eeb958e48487739b6dd26b50b275e075de16d5

Download Submit
memory/64-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/212-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/220-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/528-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/736-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/756-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/956-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/996-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1028-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1068-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1104-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1128-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1260-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1288-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1392-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1432-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1456-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1816-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1864-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1892-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1940-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2068-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2720-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3008-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3036-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3092-65-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3100-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3180-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3304-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3404-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3448-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3540-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3652-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3696-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4032-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4048-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4196-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4288-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4388-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4444-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4648-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4784-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4812-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4928-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4956-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5004-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5148-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5348-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5376-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5432-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5472-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5516-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5600-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5628-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5644-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5664-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5672-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5696-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5848-560-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5940-564-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads