f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe
Size

468KB
MD5

d8461cddfc16eb07bd7be8bd3b5ca7e6
SHA1

4700b935a24b46cc9b750e7ef0721b805ffec507
SHA256

f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8
SHA512

d2a498ea92de5c0a1797c175bd0764dcaff01f5c6ba9e12b647ad0a5cc1393540b1e6edc532a3653c25e495160ba1e32cc302e864c7483018a6f1f54453fad33
SSDEEP

3072:DqoNovLdj58U2bxuPz5Wff5kChjWXpynmHeFVqln9Q3E3GJTySFlQ:DqCo5qU2wP1WffM5Ya9Q3q2TyS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4124	Unicorn-24773.exe
2388	Unicorn-61205.exe
2756	Unicorn-57676.exe
2284	Unicorn-41029.exe
2968	Unicorn-56789.exe
464	Unicorn-50659.exe
1600	Unicorn-4443.exe
2616	Unicorn-59877.exe
1480	Unicorn-39435.exe
2324	Unicorn-45388.exe
2216	Unicorn-45653.exe
1048	Unicorn-13172.exe
396	Unicorn-23378.exe
2156	Unicorn-62181.exe
4524	Unicorn-25403.exe
2240	Unicorn-31445.exe
3488	Unicorn-28107.exe
3348	Unicorn-31253.exe
880	Unicorn-8402.exe
4564	Unicorn-884.exe
1296	Unicorn-13307.exe
640	Unicorn-65461.exe
116	Unicorn-48933.exe
4980	Unicorn-116.exe
2664	Unicorn-116.exe
2036	Unicorn-32789.exe
1328	Unicorn-61548.exe
3576	Unicorn-9746.exe
1808	Unicorn-31948.exe
2720	Unicorn-23282.exe
2080	Unicorn-28683.exe
4556	Unicorn-1284.exe
5024	Unicorn-33381.exe
1108	Unicorn-2436.exe
644	Unicorn-251.exe
3512	Unicorn-36453.exe
1376	Unicorn-43093.exe
3004	Unicorn-26949.exe
4652	Unicorn-36579.exe
628	Unicorn-26300.exe
3904	Unicorn-22459.exe
2804	Unicorn-27333.exe
3980	Unicorn-62501.exe
2352	Unicorn-13684.exe
2924	Unicorn-37035.exe
4500	Unicorn-46357.exe
3624	Unicorn-45781.exe
2828	Unicorn-58972.exe
224	Unicorn-13300.exe
1124	Unicorn-13300.exe
3868	Unicorn-62309.exe
2784	Unicorn-42443.exe
4540	Unicorn-45397.exe
2304	Unicorn-61733.exe
4064	Unicorn-52995.exe
3960	Unicorn-55795.exe
3716	Unicorn-55795.exe
2684	Unicorn-23506.exe
4768	Unicorn-41483.exe
3456	Unicorn-61084.exe
1344	Unicorn-14452.exe
4352	Unicorn-43595.exe
2800	Unicorn-36565.exe
1888	Unicorn-555.exe

Program crash 11 IoCs

pid	pid_target	Process	procid_target
12080	7072	WerFault.exe	286
15452	8500	WerFault.exe	373
8988	6040	WerFault.exe
9228	15316	WerFault.exe	826
9040	17340	WerFault.exe	929
9856	16740	WerFault.exe	914
9008	17284	WerFault.exe	925
14724	4628	WerFault.exe	821
14800	7340	WerFault.exe	975
14804	16520	WerFault.exe	980
7124	16996	WerFault.exe	945

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26239.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3724	dwm.exe
Token: SeChangeNotifyPrivilege	3724	dwm.exe
Token: 33	3724	dwm.exe
Token: SeIncBasePriorityPrivilege	3724	dwm.exe
Token: SeCreateGlobalPrivilege	16424	dwm.exe
Token: SeChangeNotifyPrivilege	16424	dwm.exe
Token: 33	16424	dwm.exe
Token: SeIncBasePriorityPrivilege	16424	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3168	f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe
4124	Unicorn-24773.exe
2756	Unicorn-57676.exe
2388	Unicorn-61205.exe
2284	Unicorn-41029.exe
464	Unicorn-50659.exe
1600	Unicorn-4443.exe
2968	Unicorn-56789.exe
2616	Unicorn-59877.exe
1480	Unicorn-39435.exe
4524	Unicorn-25403.exe
2216	Unicorn-45653.exe
2324	Unicorn-45388.exe
1048	Unicorn-13172.exe
396	Unicorn-23378.exe
2156	Unicorn-62181.exe
2240	Unicorn-31445.exe
3488	Unicorn-28107.exe
3348	Unicorn-31253.exe
880	Unicorn-8402.exe
4564	Unicorn-884.exe
1296	Unicorn-13307.exe
2664	Unicorn-116.exe
116	Unicorn-48933.exe
2080	Unicorn-28683.exe
2720	Unicorn-23282.exe
1808	Unicorn-31948.exe
2036	Unicorn-32789.exe
3576	Unicorn-9746.exe
1328	Unicorn-61548.exe
640	Unicorn-65461.exe
4980	Unicorn-116.exe
4556	Unicorn-1284.exe
5024	Unicorn-33381.exe
1108	Unicorn-2436.exe
644	Unicorn-251.exe
3512	Unicorn-36453.exe
1376	Unicorn-43093.exe
3004	Unicorn-26949.exe
628	Unicorn-26300.exe
4652	Unicorn-36579.exe
3904	Unicorn-22459.exe
2804	Unicorn-27333.exe
3980	Unicorn-62501.exe
4500	Unicorn-46357.exe
3624	Unicorn-45781.exe
2352	Unicorn-13684.exe
224	Unicorn-13300.exe
2924	Unicorn-37035.exe
1124	Unicorn-13300.exe
2828	Unicorn-58972.exe
2784	Unicorn-42443.exe
4540	Unicorn-45397.exe
4064	Unicorn-52995.exe
3456	Unicorn-61084.exe
2684	Unicorn-23506.exe
3868	Unicorn-62309.exe
3716	Unicorn-55795.exe
3960	Unicorn-55795.exe
2304	Unicorn-61733.exe
4768	Unicorn-41483.exe
1344	Unicorn-14452.exe
2800	Unicorn-36565.exe
2896	Unicorn-65324.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 4124	3168	f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe	86
PID 3168 wrote to memory of 4124	3168	f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe	86
PID 3168 wrote to memory of 4124	3168	f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe	86
PID 4124 wrote to memory of 2388	4124	Unicorn-24773.exe	88
PID 4124 wrote to memory of 2388	4124	Unicorn-24773.exe	88
PID 4124 wrote to memory of 2388	4124	Unicorn-24773.exe	88
PID 3168 wrote to memory of 2756	3168	f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe	89
PID 3168 wrote to memory of 2756	3168	f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe	89
PID 3168 wrote to memory of 2756	3168	f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe	89
PID 2756 wrote to memory of 2284	2756	Unicorn-57676.exe	92
PID 2756 wrote to memory of 2284	2756	Unicorn-57676.exe	92
PID 2756 wrote to memory of 2284	2756	Unicorn-57676.exe	92
PID 3168 wrote to memory of 464	3168	f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe	93
PID 3168 wrote to memory of 464	3168	f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe	93
PID 3168 wrote to memory of 464	3168	f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe	93
PID 2388 wrote to memory of 2968	2388	Unicorn-61205.exe	94
PID 2388 wrote to memory of 2968	2388	Unicorn-61205.exe	94
PID 2388 wrote to memory of 2968	2388	Unicorn-61205.exe	94
PID 4124 wrote to memory of 1600	4124	Unicorn-24773.exe	95
PID 4124 wrote to memory of 1600	4124	Unicorn-24773.exe	95
PID 4124 wrote to memory of 1600	4124	Unicorn-24773.exe	95
PID 2284 wrote to memory of 2616	2284	Unicorn-41029.exe	96
PID 2284 wrote to memory of 2616	2284	Unicorn-41029.exe	96
PID 2284 wrote to memory of 2616	2284	Unicorn-41029.exe	96
PID 2756 wrote to memory of 1480	2756	Unicorn-57676.exe	97
PID 2756 wrote to memory of 1480	2756	Unicorn-57676.exe	97
PID 2756 wrote to memory of 1480	2756	Unicorn-57676.exe	97
PID 3168 wrote to memory of 2324	3168	f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe	98
PID 3168 wrote to memory of 2324	3168	f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe	98
PID 3168 wrote to memory of 2324	3168	f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe	98
PID 464 wrote to memory of 2216	464	Unicorn-50659.exe	99
PID 464 wrote to memory of 2216	464	Unicorn-50659.exe	99
PID 464 wrote to memory of 2216	464	Unicorn-50659.exe	99
PID 1600 wrote to memory of 1048	1600	Unicorn-4443.exe	100
PID 1600 wrote to memory of 1048	1600	Unicorn-4443.exe	100
PID 1600 wrote to memory of 1048	1600	Unicorn-4443.exe	100
PID 4124 wrote to memory of 396	4124	Unicorn-24773.exe	101
PID 4124 wrote to memory of 396	4124	Unicorn-24773.exe	101
PID 4124 wrote to memory of 396	4124	Unicorn-24773.exe	101
PID 2968 wrote to memory of 2156	2968	Unicorn-56789.exe	102
PID 2968 wrote to memory of 2156	2968	Unicorn-56789.exe	102
PID 2968 wrote to memory of 2156	2968	Unicorn-56789.exe	102
PID 2388 wrote to memory of 4524	2388	Unicorn-61205.exe	103
PID 2388 wrote to memory of 4524	2388	Unicorn-61205.exe	103
PID 2388 wrote to memory of 4524	2388	Unicorn-61205.exe	103
PID 2616 wrote to memory of 2240	2616	Unicorn-59877.exe	104
PID 2616 wrote to memory of 2240	2616	Unicorn-59877.exe	104
PID 2616 wrote to memory of 2240	2616	Unicorn-59877.exe	104
PID 2284 wrote to memory of 3488	2284	Unicorn-41029.exe	105
PID 2284 wrote to memory of 3488	2284	Unicorn-41029.exe	105
PID 2284 wrote to memory of 3488	2284	Unicorn-41029.exe	105
PID 1480 wrote to memory of 3348	1480	Unicorn-39435.exe	106
PID 1480 wrote to memory of 3348	1480	Unicorn-39435.exe	106
PID 1480 wrote to memory of 3348	1480	Unicorn-39435.exe	106
PID 2756 wrote to memory of 880	2756	Unicorn-57676.exe	107
PID 2756 wrote to memory of 880	2756	Unicorn-57676.exe	107
PID 2756 wrote to memory of 880	2756	Unicorn-57676.exe	107
PID 2216 wrote to memory of 4564	2216	Unicorn-45653.exe	108
PID 2216 wrote to memory of 4564	2216	Unicorn-45653.exe	108
PID 2216 wrote to memory of 4564	2216	Unicorn-45653.exe	108
PID 464 wrote to memory of 1296	464	Unicorn-50659.exe	109
PID 464 wrote to memory of 1296	464	Unicorn-50659.exe	109
PID 464 wrote to memory of 1296	464	Unicorn-50659.exe	109
PID 4524 wrote to memory of 640	4524	Unicorn-25403.exe	110

C:\Users\Admin\AppData\Local\Temp\f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe
"C:\Users\Admin\AppData\Local\Temp\f48d8271d39d30186b30986c497b3d5fd2438fa609fd6f8f5743b6824f23dae8.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24773.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24773.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36453.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        8⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35237.exe
        9⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        10⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        10⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53959.exe
        10⤵
        
        PID:17024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
        9⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9887.exe
        9⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50878.exe
        9⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        9⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10187.exe
        8⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62277.exe
        9⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49488.exe
        9⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47312.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        9⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        8⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4799.exe
        8⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        8⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60140.exe
        7⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35237.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5764.exe
        9⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        10⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
        10⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42072.exe
        9⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        9⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        9⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30402.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        8⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18729.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        8⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41987.exe
        7⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        8⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        8⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        8⤵
        
        PID:17152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
        7⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38031.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        7⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
        6⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
        7⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        8⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52858.exe
        8⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58612.exe
        8⤵
        
        PID:17652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31570.exe
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        7⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        7⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        6⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46345.exe
        7⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        7⤵
        
        PID:16996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16996 -s 436
        8⤵
        Program crash
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42987.exe
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42050.exe
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17646.exe
        6⤵
        
        PID:1116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
        6⤵
        
        PID:18360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28683.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45781.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        9⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
        9⤵
        
        PID:13284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        9⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63372.exe
        8⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8500 -s 632
        9⤵
        Program crash
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        8⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        8⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        8⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45287.exe
        8⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58612.exe
        8⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        7⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56112.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56211.exe
        7⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        6⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
        7⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        8⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30584.exe
        8⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58551.exe
        8⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        7⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        7⤵
        
        PID:16924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        6⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21394.exe
        7⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
        7⤵
        
        PID:17400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48992.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35058.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62908.exe
        6⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        6⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45621.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        8⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        8⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        8⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-331.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19119.exe
        7⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
        7⤵
        
        PID:16048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        7⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62076.exe
        6⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15147.exe
        7⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
        7⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        7⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56112.exe
        6⤵
        
        PID:14324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        5⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42664.exe
        6⤵
        
        PID:13036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47882.exe
        6⤵
        
        PID:16432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21451.exe
        5⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        6⤵
        
        PID:14544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54722.exe
        5⤵
        
        PID:14012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
        5⤵
        
        PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65461.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22133.exe
        9⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        9⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33379.exe
        9⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47612.exe
        8⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        8⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        8⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12875.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        8⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        8⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
        8⤵
        
        PID:16572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        7⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56112.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        7⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        6⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64700.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
        7⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
        7⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24050.exe
        6⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19981.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21128.exe
        6⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18559.exe
        6⤵
        
        PID:15332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
        6⤵
        
        PID:16796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58972.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        6⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19301.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        8⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        8⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31737.exe
        8⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37776.exe
        7⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20025.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
        7⤵
        
        PID:13592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        6⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        7⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
        7⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6031.exe
        6⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35001.exe
        6⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        6⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63507.exe
        5⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5764.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        7⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
        7⤵
        
        PID:17352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        6⤵
        
        PID:10968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        6⤵
        
        PID:14928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        6⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        5⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        6⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10009.exe
        6⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19567.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
        5⤵
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
        5⤵
        
        PID:11184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
        5⤵
        
        PID:18356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9746.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62309.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34261.exe
        6⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
        7⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41541.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        8⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        8⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8498.exe
        7⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        7⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7209.exe
        7⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19035.exe
        6⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31704.exe
        7⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64032.exe
        7⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
        6⤵
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38647.exe
        6⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41115.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        7⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57482.exe
        7⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54112.exe
        6⤵
        
        PID:14448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37603.exe
        6⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        6⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18274.exe
        5⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
        6⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        5⤵
        
        PID:11276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exe
        5⤵
        
        PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46345.exe
        7⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
        7⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        6⤵
        
        PID:14376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        6⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22354.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24728.exe
        6⤵
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        5⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exe
        5⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        5⤵
        
        PID:4628
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 464
        6⤵
        Program crash
        
        PID:14724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44755.exe
      4⤵
      PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        5⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
      4⤵
      PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9921.exe
      4⤵
      PID:12100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26170.exe
      4⤵
      PID:17304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
        8⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58306.exe
        9⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        9⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
        9⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25928.exe
        8⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        8⤵
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
        8⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13195.exe
        7⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5755.exe
        8⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24793.exe
        7⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        7⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        7⤵
        
        PID:17736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50156.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        8⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        8⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9775.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
        8⤵
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        7⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30483.exe
        7⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
        6⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7480.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
        6⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58048.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        6⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39859.exe
        5⤵
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54837.exe
        6⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26917.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe
        7⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62387.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42219.exe
        6⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12191.exe
        6⤵
        
        PID:12132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29404.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38837.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
        7⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
        6⤵
        
        PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65321.exe
        5⤵
        
        PID:12276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61548.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46357.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        6⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61189.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        8⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        8⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        8⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 468
        9⤵
        Program crash
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        7⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        7⤵
        
        PID:13384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        7⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29403.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        7⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        7⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13570.exe
        7⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6194.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5864.exe
        6⤵
        
        PID:512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20939.exe
        5⤵
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
        6⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21266.exe
        7⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        7⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63564.exe
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        6⤵
        
        PID:13336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        6⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 80
        7⤵
        Program crash
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
        6⤵
        
        PID:12540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26610.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32296.exe
        6⤵
        
        PID:13256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60087.exe
        6⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52158.exe
        6⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        5⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        5⤵
        
        PID:13020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        5⤵
        
        PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23506.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        5⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
        6⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42885.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        7⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
        7⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        6⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        6⤵
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
        5⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
        6⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        5⤵
        
        PID:11020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        5⤵
        
        PID:16104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
      4⤵
      PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16565.exe
        6⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7794.exe
        7⤵
        
        PID:15544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
        6⤵
        
        PID:12948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23766.exe
        6⤵
        
        PID:16740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16740 -s 464
        7⤵
        Program crash
        
        PID:9856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54112.exe
        5⤵
        
        PID:14456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62387.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        5⤵
        
        PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12786.exe
      4⤵
      PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52233.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26866.exe
      4⤵
      PID:14956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
      4⤵
      PID:16700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23378.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52277.exe
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        7⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13195.exe
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24793.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        6⤵
        
        PID:17748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        6⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41323.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        6⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5794.exe
        5⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61017.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        6⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        5⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41388.exe
        5⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10882.exe
        5⤵
        
        PID:10264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49013.exe
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        6⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
        7⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21359.exe
        6⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        6⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        5⤵
        
        PID:11468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        5⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19414.exe
        5⤵
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        5⤵
        
        PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15842.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        5⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
      4⤵
      PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9784.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
      4⤵
      PID:16732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20552.exe
        7⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe
        7⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        7⤵
        
        PID:17716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32059.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37776.exe
        6⤵
        
        PID:14200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20875.exe
        5⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42722.exe
        6⤵
        
        PID:11480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exe
        6⤵
        
        PID:15516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58612.exe
        6⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59264.exe
        5⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        5⤵
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46151.exe
        5⤵
        
        PID:16404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18635.exe
      4⤵
      PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        5⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18329.exe
        5⤵
        
        PID:16112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        5⤵
        
        PID:18244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38851.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
      4⤵
      PID:11676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
      4⤵
      PID:2184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41573.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64700.exe
        5⤵
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        5⤵
        
        PID:12348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        5⤵
        
        PID:17384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13387.exe
      4⤵
      PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
      4⤵
      PID:11296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
      4⤵
      PID:9460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
      4⤵
      PID:17120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
    3⤵
    PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42811.exe
      4⤵
      PID:9468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31039.exe
      4⤵
      PID:12376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
      4⤵
      PID:17388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
    3⤵
    PID:8176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
    3⤵
    PID:11356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50610.exe
    3⤵
    PID:1240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31445.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1284.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61557.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        9⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58498.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe
        10⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10552.exe
        9⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10844.exe
        10⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        9⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        9⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
        9⤵
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13003.exe
        8⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
        9⤵
        
        PID:17600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        8⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        8⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        8⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33819.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
        8⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe
        8⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18056.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        6⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51589.exe
        8⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50005.exe
        9⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        9⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58551.exe
        9⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        8⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37776.exe
        8⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60259.exe
        8⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        8⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        7⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
        8⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        8⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        8⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20831.exe
        7⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        7⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
        7⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54396.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22133.exe
        7⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        7⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exe
        7⤵
        
        PID:17032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19154.exe
        6⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        6⤵
        
        PID:13512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe
        6⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57893.exe
        6⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        8⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53845.exe
        9⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        9⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        9⤵
        
        PID:17008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        8⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        8⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38096.exe
        8⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2530.exe
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
        7⤵
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        7⤵
        
        PID:16548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20082.exe
        6⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5780.exe
        7⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
        7⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14338.exe
        7⤵
        
        PID:17284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17284 -s 464
        8⤵
        Program crash
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40316.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        6⤵
        
        PID:16096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        5⤵
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34469.exe
        6⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        7⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        8⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        7⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
        7⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4155.exe
        6⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
        7⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
        6⤵
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46345.exe
        6⤵
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15401.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8962.exe
        5⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
        5⤵
        
        PID:11856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21496.exe
        5⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
        5⤵
        
        PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33381.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36565.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12932.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35749.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21394.exe
        9⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18329.exe
        9⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        9⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42072.exe
        8⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        8⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14338.exe
        8⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63740.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        7⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12402.exe
        7⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50156.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        7⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        7⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18056.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
        6⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        6⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe
        5⤵
        Executes dropped EXE
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5764.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42501.exe
        8⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        8⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        8⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
        7⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        7⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54816.exe
        7⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63740.exe
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3919.exe
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        6⤵
        
        PID:15384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        6⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14690.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27301.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        6⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21458.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        5⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        5⤵
        
        PID:16688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        5⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35237.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30402.exe
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        7⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        7⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        6⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        6⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51987.exe
        5⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        6⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
        6⤵
        
        PID:11904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        5⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43232.exe
        5⤵
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7202.exe
        5⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
      4⤵
      PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11220.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        6⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10009.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13871.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
      4⤵
      PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        5⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
        5⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        5⤵
        
        PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52396.exe
      4⤵
      PID:8876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54130.exe
      4⤵
      PID:13028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
      4⤵
      PID:15552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
      4⤵
      PID:16980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
      4⤵
      PID:17940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2436.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        6⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12932.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33196.exe
        8⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
        8⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
        9⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        8⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe
        8⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
        7⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        7⤵
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        7⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1339.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
        8⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7072 -s 652
        8⤵
        Program crash
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        7⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4738.exe
        7⤵
        
        PID:16564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        6⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        7⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46345.exe
        7⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12930.exe
        7⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41680.exe
        6⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46681.exe
        6⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65324.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
        6⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5764.exe
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46345.exe
        8⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        8⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        7⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62274.exe
        7⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
        7⤵
        
        PID:17128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        6⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        6⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63507.exe
        5⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30079.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        6⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        5⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        5⤵
        
        PID:12160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33122.exe
      4⤵
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27093.exe
        6⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10020.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        7⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44903.exe
        7⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        6⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
        6⤵
        
        PID:16112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37595.exe
        5⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exe
        6⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        5⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26688.exe
        6⤵
        
        PID:13160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35961.exe
        5⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        5⤵
        
        PID:15992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
      4⤵
      PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        5⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28444.exe
        6⤵
        
        PID:16364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        5⤵
        
        PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
      4⤵
      PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        5⤵
        
        PID:15948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58393.exe
      4⤵
      PID:12072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
      4⤵
      PID:4236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24261.exe
        5⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27301.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        8⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        7⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        7⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
        6⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9227.exe
        5⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        6⤵
        
        PID:16964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13106.exe
        5⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
        5⤵
        
        PID:12484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        5⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        5⤵
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42843.exe
      4⤵
      PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34411.exe
        5⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-996.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        6⤵
        
        PID:12124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31737.exe
        6⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7922.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        5⤵
        
        PID:13812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29430.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6626.exe
      4⤵
      PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23861.exe
        5⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        5⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40186.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
      4⤵
      PID:8740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34959.exe
      4⤵
      PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
      4⤵
      PID:6888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
      4⤵
      PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        6⤵
        
        PID:13088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        6⤵
        
        PID:18428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
        5⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
        6⤵
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        5⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        5⤵
        
        PID:15316
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15316 -s 468
        6⤵
        Program crash
        
        PID:9228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29403.exe
      4⤵
      PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
        5⤵
        
        PID:12972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6194.exe
      4⤵
      PID:8884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
      4⤵
      PID:13440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
      4⤵
      PID:6240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56467.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
      4⤵
      PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        5⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        5⤵
        
        PID:12872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
        5⤵
        
        PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
      4⤵
      PID:9496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
      4⤵
      PID:13944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41919.exe
      4⤵
      PID:17324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
    3⤵
    PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
      4⤵
      PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
      4⤵
      PID:11920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
      4⤵
      PID:1508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14100.exe
    3⤵
    PID:7980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33367.exe
    3⤵
    PID:12892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
    3⤵
    PID:3640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45653.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43093.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        6⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1604.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
        8⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
        8⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        8⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15874.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        7⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        7⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        7⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        8⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38480.exe
        7⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        7⤵
        
        PID:16956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        6⤵
        
        PID:11336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45458.exe
        6⤵
        
        PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43804.exe
        5⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34411.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        7⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        7⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54435.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31734.exe
        6⤵
        
        PID:16764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59283.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        6⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21394.exe
        7⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        7⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42727.exe
        7⤵
        
        PID:16520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16520 -s 464
        8⤵
        Program crash
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41543.exe
        6⤵
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        5⤵
        
        PID:8164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33215.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
        5⤵
        
        PID:15236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exe
        5⤵
        
        PID:16008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22459.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        5⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        7⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        7⤵
        
        PID:15948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
        6⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        6⤵
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
        5⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        6⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        6⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe
        7⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        6⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16370.exe
        5⤵
        
        PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
        5⤵
        
        PID:12828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        5⤵
        
        PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
      4⤵
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54837.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        6⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
        6⤵
        
        PID:14332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        6⤵
        
        PID:17720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8971.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        5⤵
        
        PID:13360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        5⤵
        
        PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10196.exe
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        5⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        5⤵
        
        PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
        5⤵
        
        PID:13628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35298.exe
      4⤵
      PID:9316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
      4⤵
      PID:13544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62140.exe
      4⤵
      PID:16596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44645.exe
        5⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
        6⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25810.exe
        7⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        7⤵
        
        PID:15440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        7⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59563.exe
        7⤵
        
        PID:12516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37080.exe
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9823.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
        6⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        6⤵
        
        PID:10520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37803.exe
        5⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        6⤵
        
        PID:13116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        5⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        5⤵
        
        PID:16544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
      4⤵
      PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54613.exe
        5⤵
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        5⤵
        
        PID:13772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        5⤵
        
        PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13106.exe
      4⤵
      PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59961.exe
      4⤵
      PID:12464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
      4⤵
      PID:14740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
      4⤵
      PID:6404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25045.exe
      4⤵
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26213.exe
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48567.exe
        6⤵
        
        PID:16680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
        5⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        5⤵
        
        PID:13820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        5⤵
        
        PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
      4⤵
      PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        5⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
        5⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        5⤵
        
        PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36889.exe
      4⤵
      PID:10252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18559.exe
      4⤵
      PID:15188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
      4⤵
      PID:612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
      4⤵
      PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
        5⤵
        
        PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
      4⤵
      PID:11812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
      4⤵
      PID:4644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
    3⤵
    PID:8468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
    3⤵
    PID:13400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2737.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45388.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45388.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        5⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        6⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        6⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        5⤵
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33411.exe
        5⤵
        
        PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        5⤵
        
        PID:11568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        5⤵
        
        PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
      4⤵
      PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
      4⤵
      PID:12028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41483.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
      4⤵
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42024.exe
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
        6⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        5⤵
        
        PID:10328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        5⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30784.exe
        5⤵
        
        PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
      4⤵
      PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9487.exe
      4⤵
      PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61610.exe
      4⤵
      PID:16584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
    3⤵
    PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12324.exe
      4⤵
      PID:8608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exe
      4⤵
      PID:13072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
      4⤵
      PID:18416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26460.exe
    3⤵
    PID:8092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26120.exe
    3⤵
    PID:12168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
    3⤵
    PID:15940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27333.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62901.exe
      4⤵
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35237.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        6⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        6⤵
        
        PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        5⤵
        
        PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9803.exe
      4⤵
      PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54432.exe
        5⤵
        
        PID:16668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
      4⤵
      PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
      4⤵
      PID:12448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
      4⤵
      PID:976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50599.exe
      4⤵
      PID:8352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10892.exe
      4⤵
      PID:11292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exe
    3⤵
    PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
      4⤵
      PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10964.exe
        5⤵
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        5⤵
        
        PID:11828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
      4⤵
      PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36905.exe
      4⤵
      PID:12308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54336.exe
      4⤵
      PID:7256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
    3⤵
    PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
      4⤵
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
      4⤵
      PID:14268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28691.exe
      4⤵
      PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
    3⤵
    PID:9000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52064.exe
    3⤵
    PID:12668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17861.exe
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
    3⤵
    PID:13600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
    3⤵
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17765.exe
      4⤵
      PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        5⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14984.exe
        5⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57386.exe
        5⤵
        
        PID:17340
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17340 -s 464
        6⤵
        Program crash
        
        PID:9040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41083.exe
      4⤵
      PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6742.exe
      4⤵
      PID:5004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
    3⤵
    PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10193.exe
      4⤵
      PID:15148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28991.exe
      4⤵
      PID:16040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
    3⤵
    PID:10344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
    3⤵
    PID:14352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40074.exe
    3⤵
    PID:16160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
  2⤵
  PID:6036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12426.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12426.exe
  2⤵
  PID:3096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5412.exe
    3⤵
    PID:9188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
    3⤵
    PID:13756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
    3⤵
    PID:4832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe
  2⤵
  PID:9640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
  2⤵
  PID:11660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
  2⤵
  PID:16612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 7072 -ip 7072
1⤵
PID:13064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 8500 -ip 8500
1⤵
PID:14640

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3724

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:16424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 17340 -ip 17340
1⤵
PID:10392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 15164 -ip 15164
1⤵
PID:9044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4628 -ip 4628
1⤵
PID:8708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 7340 -ip 7340
1⤵
PID:14788

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:15040

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 16996 -ip 16996
1⤵
PID:7304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6008 -ip 6008
1⤵
PID:7704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4644 -ip 4644
1⤵
PID:8232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1820 -ip 1820
1⤵
PID:8828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 18416 -ip 18416
1⤵
PID:17764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5296 -ip 5296
1⤵
PID:8348

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:17276

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:8388

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\96220d810f6745168d54763335f7fcc6 /t 3928 /p 3896
1⤵
PID:6256

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:17724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe

Filesize
468KB

MD5
8d1c316839043fb1cff8a777ee11e538

SHA1
75bc057c2d550fee90b013a0c0c81ff249d16310

SHA256
dc7cfa4fcf860791e1e2953890b6be8d40fcd133cb2cb53f1c7c36d50a4e77a7

SHA512
1c8d9406343c8b5ee55d467daf74b1ea0045e71409c54652f315dfa26c28df13ddec491907c3ea4bf1cc99ff06379d37e6339f35d3dd2155e54f27f0d2376ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1284.exe

Filesize
468KB

MD5
536e372fe1877b985ecaa8464733ef08

SHA1
b901798b7de9568cc3069b3dc447405af298284f

SHA256
f3833d40f877a394d90f3320e974aab141827cd2ce201313cc2334e4a4534952

SHA512
bba458878c39c03970e7f63e473d7e47279a802bab4f921dc7bbcb059757a71124b54370d6e38c939034a16569fe901fc9adbce38defc1266e6b2e3eb40d942f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13172.exe

Filesize
468KB

MD5
8b7505d0be7961051680400a4d8ea03e

SHA1
eea356e29a8c7ba61af797de883e3eb4ca85c1ee

SHA256
14f91c1dea05a8c65ed55f45ba8c22f134d6599938e2a8f22d1ce9c5cdaabca7

SHA512
1879a9db159a417e2e56e06a843a780550b747a7678b768faa1603b2785a5e8f582b25f17ddf4813464eefdf78f4b5a6929ba4581ed3931129f1504e2c286587

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe

Filesize
468KB

MD5
5de5136c1e6906c6a0c667691944b0f0

SHA1
be4205e5b834a7444542fb4c8aba4d4ee8949973

SHA256
f904647554304f756b1579f29266c2b6921d3700f85056d96870d8816a510052

SHA512
fe7a6492aef920acddc64c876ad06c907a3bbf602f9822235b074e020ed3bd89139c25493eea2acb9895937cc8c23e5764e2937525b45ad9b754b6ef699aea04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe

Filesize
468KB

MD5
b21739505ae731260c8007c10b89798d

SHA1
9145b5aa92b8f0a2aa6f7851f6d6c0a8e26cacee

SHA256
eeee308895d34c03b7aaab410af0209f59066ea9efff81e34b1c7f637bad1abf

SHA512
66fad405d63076f1f3e7b679ad503575139f62e6195730105133b3dfab520660650ae692fbf47f5c8948d41dbe1447d910c582688409bc6cc0e90aa9c5cbcea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23378.exe

Filesize
468KB

MD5
705f4a209fffe6a007453383e04f02f5

SHA1
272622a5a2a8d74e4ebffd5e2f048551242bd6e4

SHA256
b2de179f678c8b5ebf2fcebad3aa37bb4a25a4fd16bff72c1780aa570db5586a

SHA512
2ad47c9a252504f3e2f893f767417e4452fbb78e8e31d780642f810e298b7a60beddeb8d5c65cc62a114c3aa4233544ffce54f3e5bf6443207b83620623e9598

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24773.exe

Filesize
468KB

MD5
dd061e163cd2018c33cea14b08fe355b

SHA1
6867dc7a06036e0714f6dd98c39ad0d67ece71d0

SHA256
a4c3a09a904c19e4af38ba82d93c5f76f2e1b4150541608515ae7bc0201657c6

SHA512
71c66301c6030899fa30fbdd13696b20938cbff6d56d077ef93f0e77edb27313e37e733909bd2a5a79b6eff8a29b944a0fadb43a47c2306b1d56f2589167681f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe

Filesize
468KB

MD5
f5da8fef1d02b7e5fa288ffbd204fcd0

SHA1
4c28aacab76cc81c4f33efd80f77e6ceb2aae2c4

SHA256
1d97daf701f8c05d41b8f1e7138a12860f8af9b3468d1a0396991fe225665439

SHA512
da3a497b83a5655f91ac8096257f3734db5d26b84b78694b90ccb55530e06bb49b7201571b37b4981ed1553f6f38bf49c6fc155660cc071ac9c24ac53dcc9e4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe

Filesize
468KB

MD5
8e68dcfd15027a7621f189ca9d615be3

SHA1
0bbdb9263e228d2db912f0105f24e6973816f07a

SHA256
02f21cf71f5f8d8c6459e28d8b575198bb9d09352df02e2081a3b37c315cdc91

SHA512
958e3265cc0566517a68fd0803bbc29b0c7529c2a31d37946b89f72b7f374733d7d2d1beb725b98742679b229554f6e489948b952145fe76edf2b37aa4c00ca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28683.exe

Filesize
468KB

MD5
feb69e271cd52818c2b8416b87d502aa

SHA1
e47a182150a6803784bbe28090cdb34ca6ff3eaa

SHA256
b4042912b96499081dc948821e52fc49c2aaf7990c8b8e6120638f1745488e6d

SHA512
36b557e9a91793173b6a0fff7012c7eada68126b033ca85f66501dc348b09b141e83039f4f1c1a46329f27c2cb3e72d4f6f74d2848b8c37e6a28ebd0452ddde8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe

Filesize
468KB

MD5
f205032fbfea8006c620b5f9aa6d14c5

SHA1
bfe60898dc271a9a8a2bae0a0e05456f1ffd1e6f

SHA256
f91489308694cac57c50f55639429b72981386fd8d46701f308b6b5b893e3259

SHA512
bd64f618000ef617276176cf379e4f89eeecc2ef8d7fcb8b916831e96f88d3c6d0500b9e7d71e1d4edc6b9750b86ce2e32873d040112ec64de7644ccaac07502

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31445.exe

Filesize
468KB

MD5
4474566ad8e8f9498b9249ae12b9f336

SHA1
ffb2803f79ae84329ce8227eae737b03c706fc9f

SHA256
1c13d81cdd78b6f36cd7e0f8cd44141b0081886a032fb3f6209566dcc1dd0f89

SHA512
ed905382ad18dae9ab18ac9ed05cddbd0f025d1fb21665e8cd80ea44825e0ed11d37a819767006631dc5cfcd98fdcae1c24749173711f3507ee036aaa6a78bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe

Filesize
468KB

MD5
39a1b972e7c9f7d6625c93b4dbc77819

SHA1
d19032be5e9205c0a956675aab258bd6c7ebe42b

SHA256
716a9ac7961db9dfaaaf991def607c94b8111f57a2461eb2a1a1397829fcf56a

SHA512
1029639b70f844dc8af74883aa612fb6f39d1b19f1c260f86da0f8cc1b57ef1756ac6d152a3c38f9aa328a03b3674718527b8284130c44f0a37e943f159a28d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe

Filesize
468KB

MD5
1031644edc90e6b70d979720fffa76fa

SHA1
3d798e3d4e36a32ace6e17e9fd194becbf274877

SHA256
399de379dabbec6d952d73caa0879ebb778c46f660e018db40e4d45d3d44ea0a

SHA512
4b71680eb3d170c61a13a7e31c8296fa4c2bf4fe41141a596ac336695874e558ae7bbfce43b2c320c1c99aabe90e0ef5ee8ca650f80941ff4ec9a05f982b72bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33381.exe

Filesize
468KB

MD5
e70ea56dd968a7b98f020d2de325bf9b

SHA1
d55142ea9a9abf35ffc0bfacb5a8791f4a9f1b57

SHA256
3c66ab523799ceead355321b1470512ce1632159893ffcb5d21968ed0939f7ac

SHA512
18a286110ff706095314c6d98bb11e4527ebae29f2ea74226923c824e94bb0efcbc6720dd6974b398e61505ea46152d71856a5b0245e2f1a7fb639d11c9baa38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe

Filesize
468KB

MD5
615674bbe4815b8c061007b060f15f6e

SHA1
925fc1fe2453b8e2a0142d479badf795af3d7457

SHA256
e20e5b698a85a70d822cee6d63bab1ca7dbc9e370ee8d856f4cba419cd218694

SHA512
343f3bb20046c31e3f98658a5b67c37c04dad4e19a389f63695faaec26633f09752b0bebac76d7d55c3ece9060a8bd0a8bfc7e7a53e1c7c9b9e8723def511b1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe

Filesize
468KB

MD5
e9db3cbea80536761dfe2ef91e93e83b

SHA1
5365c0d75d7fdf2f5a56336021d74bc6ae3a5015

SHA256
9b4452951dd2913ac8746a2a26bc2c7d029ebd4b42217f9f9142f2a4f1c91bd2

SHA512
bdae79a0a49d2d85ef0ceb37eb04ef41178ad70caeed7a705c25a50119e845560ae25aae3dd0eb0a1f4c8d653b03f322d56fefbf8dc06c8fdce7de01359be9d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe

Filesize
468KB

MD5
8c75489af185a374b17c76ff5f0c5fbc

SHA1
f619869713d4f95abbe58eb128a1e007bf80b246

SHA256
b931a34b39b175421124d0ca07da45276c62fe99129c12942f5f204f7f59b0a5

SHA512
2838c1742905306dd2884f5f94fc05eb145777e28f6e0133e462c1ce4f12cfc8c179bbe5be199721eedf21c1b821eae12c0dfe54baa53c722aa84a4998ba7fa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45388.exe

Filesize
468KB

MD5
210837c944d257e523f5ef8e0355fb43

SHA1
7e8fdd932a6a848e23c8f654bb94cfad48787e44

SHA256
a4f555929e8c46e6c4fc830246056ddc63987a2f74e005744e5c52c300c53e6c

SHA512
e6bd58f4b344b1e5e2fd758f1599ad4ea19512ab23e66ba5d3073fe49e52ca500a85a041ee3ef4d2e483cce18a5e1f64825592d1941439aa051455c2689c3fdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45653.exe

Filesize
468KB

MD5
0fa1828c26e010a67e7dee9c01e44bf6

SHA1
f0acf7b00163b951797e9fef07ac0cde9989d593

SHA256
76448c699a2d5046bafbc9878e718943a18d2bae6ecbe18996c055c4c93f0a86

SHA512
45594c064a0c2e1aa6465c9ce1e6dea7d2661d8b9495eccb740cc38880b0021cbc3da54907d0aa11821dca42a6b20d0f707c45a664e5df6de9686a58bf9b76be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe

Filesize
468KB

MD5
367fdac1207c9f263cb9c5be2edcf199

SHA1
33aa57550a0aeda75ff2ada404a23bcb9f57c93d

SHA256
24ce34520974c77d58d681e9e481774cca5bc0dcd2bc573f133a1336017e973f

SHA512
952480dcc9a722aeee9e5270ca2454234cf75eef0f25df76d4a73a465ddbcf8c74f84f599b477968a04f909151e1129bd7a6eef8c4a34d8f1ab4529ec3ae7bc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe

Filesize
468KB

MD5
3a832dfbb08eccd437e4aaecd0ac36c8

SHA1
0248cc8ab8acc3dc8981b497ebf4a4ee2f7d30ff

SHA256
45115c168ab0c1a39041ff4c7dca01533441c40faa5e723c9f9728f8a59d9bdc

SHA512
1797cac6f7f2c5e82fbb32ea84d14ac1bc67ad3984f5fdab03b966ca2bd77a16ad40b3b3c5c6224dc005bd851bffaa3d4acfc8cafc0c071669a7ca8307637251

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe

Filesize
468KB

MD5
8fe8e57d0016ac8cfc17040ae2c21593

SHA1
66ee03edfdb6db34e02cb91c964cd2c3a34a6964

SHA256
0f99956122d9915c23755ace6e10d762340d7fe00d2abd54eb18051bea1c2c3e

SHA512
fae7f2cec560b16b9d9031e36f51650ae7c9458326c9a229fdb4affd5fd9af6fff8e4998b7de237b6e26e2858e785cbf4f185a550bd9692e59e884820ddde62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe

Filesize
468KB

MD5
6fba093b266c96ec5a4d1f1e17ccd617

SHA1
ea5b233514d7599195116bcebd91b6b0c8f5144c

SHA256
f2ad7db6e74c03d67c1871567c9b2ad61991604461931c6970ae77b706c432a2

SHA512
5cbb8c8b1447d6b2b63e5aba999be969cb9589ce555bd29cf093a41dc4a787c1497636b749fccb63128ed505abc0ed2c390e6be38b81fb57a6366c09a30387cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe

Filesize
468KB

MD5
07fc368a8ae9bd14c57cad0b0822d323

SHA1
fe3c6026b2e4a288b81ed9c18bfe0b6a9b024a0c

SHA256
4fedfac354f41c62697e90cabaadcc8d1442dd8b54770934e9896ea776dfbfea

SHA512
9001a8b9f24549648a7e1590c1b6a26b2409d64ce1cdeb688930387c77167339db1149bfdf9b02accdfa3354bd0d037fd40eaaade0f40a7eb856dfa141d03a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe

Filesize
468KB

MD5
a5556136395a17145e5e5838eec01d67

SHA1
7bc6b38bbb66b891de258af25fffc21707692a43

SHA256
421665471107f831c7e387731ffaebb4a5b289ea015d245319b6ef5799bf18c8

SHA512
bb3735b63cf80a275d6412288be55f5e529aca2e2af9f3123aa417332fb3c08333ff61a849a821ff5c3f72da4464c3aa7523628629718c6e356186e9722590d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe

Filesize
468KB

MD5
523f425ff1d75deb918fd1a244cb61bc

SHA1
54e98c20152d61cc1c978ae4e3649e37fd91e3d5

SHA256
f061772eb0e991ea292f55ebde0e41c9f190f39ec592b2474c8356278a8f074c

SHA512
4ad2d1cb58d971afa0696ae7444d5f9592700d43fd9e51376bfbb41bbe0587a5a1f409adba0e206d0b33f6d9209bc99625cf406b3b4edab7ab3add7ed0a3136b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61548.exe

Filesize
468KB

MD5
0c6491293c7e78d471302a0e72a19448

SHA1
e2351ada2d8628fef074ae646bc836e81452e7f2

SHA256
c8cb17d11f9e2eee244ebd85868ab5b74bc4d72f667a1098d1f7922c94006d36

SHA512
a45a8d2c793ba712e0c0ef0641efae6ea9fc24d568d4ea76842cc4c5ff6bbffbc11de15b30d65b0aeb921223d427240d39c7244f3d33eb755b1dadbd17ba497d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe

Filesize
468KB

MD5
7426cabfdef75a0e3eddf1f41fef8c00

SHA1
864c8dd539fe4f3277a80f7dc4446892e5bc073d

SHA256
0e3808535fddbab8703d2984b34362a16b96c320412fb36b8e8c084234590d85

SHA512
06bdbc8154b30ae282b2322a5732b6d3e5bc2b1be516e70e808d90556267517323c40e0ea002846bb27fd6b18e7d2f5cd722aff21401a082aafc348cb29f4991

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65461.exe

Filesize
468KB

MD5
8c3459c6b6dd750c227056e1e38c29cb

SHA1
af1a7b716609b7cf6282161aeea27643d8e9bfdd

SHA256
23de7f12b8a14ed139267ce26794a78713d1b7af8421558a428d3dce1ae29285

SHA512
d8925292cf266939b50ac5be21084eae4eb5ab555a53478700e3f90680fa8971d28ffaca97c2aa47d69d515a9432c7e230f1697b7ae3629770238fc0bce4b471

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe

Filesize
468KB

MD5
98cc0a964d1981a83245ff6bcc44e8bb

SHA1
9d6e1a7a37638344c6a609aa597cc9c1e49d64f5

SHA256
66841edb48b85c9be3b38bfff9fb3c1bf1907c12673f6f87584e3fe5dfb962d6

SHA512
70ce5f9b85d7ec6f4a07e8ca0c557495c5d57fe17391df030aecb3d58ee322908b73c6cb8b1ed75c87268f9cb747ed705447e052710658345883e20bef93d0e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe

Filesize
468KB

MD5
f01e2e0d23a4fdbe5c9bdb0e5dcd756d

SHA1
c881cbd661955d1fe69db53959a6bec42bbf5835

SHA256
a18cd1df5b0b72fc9d8d98400fe71e6c69ae218955a900680c5e21c63efc941d

SHA512
5a909f7199e4af096cd10591552539ab1a5029a635486a84f81bed3a14d9452079aca32a3523f2a2bb9194f32029458658c8ced3bf03369c71ea2bce7dd4623e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9746.exe

Filesize
468KB

MD5
213e67d9f47d142dfb2414ded47919f7

SHA1
23ab845f5ff6835a30679ba936d1b2f7c6ae1032

SHA256
c85e9cda79ddc42667154017e1ad2bf35927cc9a1a4787128ec6baaf3b41c145

SHA512
254e15f52697768240b71f688a2f57169b786f75ec346a058e02748c45dfb465c8fe08d70b522684b6fbc42bba653faff29324509fa02debbd468946438f48c6

Download Submit
memory/116-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/224-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/396-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/400-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/464-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/628-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/640-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/644-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/756-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/848-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/920-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1048-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1108-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1164-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1296-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1328-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1344-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1376-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1436-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1600-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1808-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1888-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2156-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2420-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2720-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2828-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3168-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3248-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3284-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3348-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3388-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3488-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3512-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3576-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3580-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3624-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3672-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3868-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3904-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3908-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3980-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3988-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4124-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4188-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4380-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4444-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4500-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4524-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4556-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4768-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4792-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4856-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4980-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/8352-3392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14544-3888-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15336-2491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/17324-3433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads