c67feacce622ca9f2fc7c0397a63de6126c79658e24b4b68fcce32c0bc46dafd

Analysis

max time kernel
120s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan.Win32.Fareit.VB.exe
Size

468KB
MD5

88185799fb7e7e670179d4f66beecec0
SHA1

e6139b0960c545a76d6aaadb8dfbcfaae07e6402
SHA256

c67feacce622ca9f2fc7c0397a63de6126c79658e24b4b68fcce32c0bc46dafd
SHA512

8c6d5335d18b22955b973f16cb7100b51b0ccbb90a87a712981bd9333f1a81ecf321e8bc0b9a8689952a28cdb51db6a8c593b4f27fa0a7fc8d3b8351ccc5fdcd
SSDEEP

3072:TpA1ogYnI05ptbYnPz4jef8/EC0vPvpX/mHe6Vs/2YXThGCukQl+:TpCom8ptkPEjefZhZn2YDoCuk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3392	Unicorn-21047.exe
3468	Unicorn-60538.exe
3636	Unicorn-58078.exe
4868	Unicorn-37879.exe
4608	Unicorn-12305.exe
1208	Unicorn-57977.exe
428	Unicorn-56253.exe
3504	Unicorn-56130.exe
560	Unicorn-36264.exe
348	Unicorn-49031.exe
1452	Unicorn-32238.exe
1288	Unicorn-32503.exe
1172	Unicorn-52601.exe
2484	Unicorn-6929.exe
3100	Unicorn-50877.exe
2252	Unicorn-25098.exe
4424	Unicorn-25975.exe
3136	Unicorn-44349.exe
3612	Unicorn-50479.exe
2532	Unicorn-50479.exe
3940	Unicorn-49986.exe
3900	Unicorn-49721.exe
3668	Unicorn-49986.exe
4692	Unicorn-41056.exe
4680	Unicorn-30120.exe
1800	Unicorn-30120.exe
2492	Unicorn-43856.exe
1020	Unicorn-30120.exe
232	Unicorn-30120.exe
2896	Unicorn-39461.exe
4536	Unicorn-16650.exe
748	Unicorn-42031.exe
4720	Unicorn-17911.exe
4324	Unicorn-57874.exe
4104	Unicorn-38885.exe
1332	Unicorn-38885.exe
4672	Unicorn-58751.exe
3604	Unicorn-16493.exe
1792	Unicorn-65502.exe
3892	Unicorn-44070.exe
1968	Unicorn-43266.exe
1880	Unicorn-19639.exe
3184	Unicorn-35205.exe
2536	Unicorn-44911.exe
4496	Unicorn-44911.exe
5008	Unicorn-36743.exe
3172	Unicorn-60178.exe
2820	Unicorn-60178.exe
3180	Unicorn-35788.exe
4448	Unicorn-62024.exe
648	Unicorn-48289.exe
1560	Unicorn-157.exe
4020	Unicorn-20023.exe
3088	Unicorn-20023.exe
920	Unicorn-53856.exe
3420	Unicorn-12055.exe
1600	Unicorn-35326.exe
3064	Unicorn-57805.exe
5092	Unicorn-63743.exe
4360	Unicorn-41853.exe
4776	Unicorn-61906.exe
4040	Unicorn-50785.exe
4328	Unicorn-5113.exe
4184	Unicorn-27157.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
13668	13408	WerFault.exe	647
14276	12844	WerFault.exe	607
15896	12844	WerFault.exe	607
17844	4716	WerFault.exe	994

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6929.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4140	dwm.exe
Token: SeChangeNotifyPrivilege	4140	dwm.exe
Token: 33	4140	dwm.exe
Token: SeIncBasePriorityPrivilege	4140	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3516	Trojan.Win32.Fareit.VB.exe
3392	Unicorn-21047.exe
3468	Unicorn-60538.exe
3636	Unicorn-58078.exe
4868	Unicorn-37879.exe
428	Unicorn-56253.exe
1208	Unicorn-57977.exe
4608	Unicorn-12305.exe
3504	Unicorn-56130.exe
560	Unicorn-36264.exe
348	Unicorn-49031.exe
1288	Unicorn-32503.exe
3100	Unicorn-50877.exe
2484	Unicorn-6929.exe
1452	Unicorn-32238.exe
1172	Unicorn-52601.exe
2252	Unicorn-25098.exe
4424	Unicorn-25975.exe
3136	Unicorn-44349.exe
3612	Unicorn-50479.exe
2532	Unicorn-50479.exe
1020	Unicorn-30120.exe
4692	Unicorn-41056.exe
1800	Unicorn-30120.exe
4680	Unicorn-30120.exe
3900	Unicorn-49721.exe
3940	Unicorn-49986.exe
232	Unicorn-30120.exe
2492	Unicorn-43856.exe
3668	Unicorn-49986.exe
2896	Unicorn-39461.exe
4536	Unicorn-16650.exe
748	Unicorn-42031.exe
4324	Unicorn-57874.exe
4720	Unicorn-17911.exe
4104	Unicorn-38885.exe
1332	Unicorn-38885.exe
1792	Unicorn-65502.exe
4672	Unicorn-58751.exe
3892	Unicorn-44070.exe
3604	Unicorn-16493.exe
1880	Unicorn-19639.exe
3184	Unicorn-35205.exe
4496	Unicorn-44911.exe
1968	Unicorn-43266.exe
3172	Unicorn-60178.exe
2820	Unicorn-60178.exe
5008	Unicorn-36743.exe
4020	Unicorn-20023.exe
3180	Unicorn-35788.exe
2536	Unicorn-44911.exe
1560	Unicorn-157.exe
3420	Unicorn-12055.exe
1600	Unicorn-35326.exe
4448	Unicorn-62024.exe
3088	Unicorn-20023.exe
648	Unicorn-48289.exe
920	Unicorn-53856.exe
3064	Unicorn-57805.exe
5092	Unicorn-63743.exe
4360	Unicorn-41853.exe
4776	Unicorn-61906.exe
4040	Unicorn-50785.exe
4328	Unicorn-5113.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 3392	3516	Trojan.Win32.Fareit.VB.exe	84
PID 3516 wrote to memory of 3392	3516	Trojan.Win32.Fareit.VB.exe	84
PID 3516 wrote to memory of 3392	3516	Trojan.Win32.Fareit.VB.exe	84
PID 3392 wrote to memory of 3468	3392	Unicorn-21047.exe	87
PID 3392 wrote to memory of 3468	3392	Unicorn-21047.exe	87
PID 3392 wrote to memory of 3468	3392	Unicorn-21047.exe	87
PID 3516 wrote to memory of 3636	3516	Trojan.Win32.Fareit.VB.exe	88
PID 3516 wrote to memory of 3636	3516	Trojan.Win32.Fareit.VB.exe	88
PID 3516 wrote to memory of 3636	3516	Trojan.Win32.Fareit.VB.exe	88
PID 3468 wrote to memory of 4868	3468	Unicorn-60538.exe	90
PID 3468 wrote to memory of 4868	3468	Unicorn-60538.exe	90
PID 3468 wrote to memory of 4868	3468	Unicorn-60538.exe	90
PID 3636 wrote to memory of 4608	3636	Unicorn-58078.exe	92
PID 3636 wrote to memory of 4608	3636	Unicorn-58078.exe	92
PID 3636 wrote to memory of 4608	3636	Unicorn-58078.exe	92
PID 3392 wrote to memory of 1208	3392	Unicorn-21047.exe	91
PID 3392 wrote to memory of 1208	3392	Unicorn-21047.exe	91
PID 3392 wrote to memory of 1208	3392	Unicorn-21047.exe	91
PID 3516 wrote to memory of 428	3516	Trojan.Win32.Fareit.VB.exe	93
PID 3516 wrote to memory of 428	3516	Trojan.Win32.Fareit.VB.exe	93
PID 3516 wrote to memory of 428	3516	Trojan.Win32.Fareit.VB.exe	93
PID 4868 wrote to memory of 3504	4868	Unicorn-37879.exe	96
PID 4868 wrote to memory of 3504	4868	Unicorn-37879.exe	96
PID 4868 wrote to memory of 3504	4868	Unicorn-37879.exe	96
PID 3468 wrote to memory of 560	3468	Unicorn-60538.exe	97
PID 3468 wrote to memory of 560	3468	Unicorn-60538.exe	97
PID 3468 wrote to memory of 560	3468	Unicorn-60538.exe	97
PID 428 wrote to memory of 348	428	Unicorn-56253.exe	98
PID 428 wrote to memory of 348	428	Unicorn-56253.exe	98
PID 428 wrote to memory of 348	428	Unicorn-56253.exe	98
PID 3516 wrote to memory of 1452	3516	Trojan.Win32.Fareit.VB.exe	99
PID 3516 wrote to memory of 1452	3516	Trojan.Win32.Fareit.VB.exe	99
PID 3516 wrote to memory of 1452	3516	Trojan.Win32.Fareit.VB.exe	99
PID 4608 wrote to memory of 1288	4608	Unicorn-12305.exe	100
PID 4608 wrote to memory of 1288	4608	Unicorn-12305.exe	100
PID 4608 wrote to memory of 1288	4608	Unicorn-12305.exe	100
PID 3636 wrote to memory of 1172	3636	Unicorn-58078.exe	101
PID 3636 wrote to memory of 1172	3636	Unicorn-58078.exe	101
PID 3636 wrote to memory of 1172	3636	Unicorn-58078.exe	101
PID 1208 wrote to memory of 2484	1208	Unicorn-57977.exe	102
PID 1208 wrote to memory of 2484	1208	Unicorn-57977.exe	102
PID 1208 wrote to memory of 2484	1208	Unicorn-57977.exe	102
PID 3392 wrote to memory of 3100	3392	Unicorn-21047.exe	103
PID 3392 wrote to memory of 3100	3392	Unicorn-21047.exe	103
PID 3392 wrote to memory of 3100	3392	Unicorn-21047.exe	103
PID 560 wrote to memory of 2252	560	Unicorn-36264.exe	104
PID 560 wrote to memory of 2252	560	Unicorn-36264.exe	104
PID 560 wrote to memory of 2252	560	Unicorn-36264.exe	104
PID 1452 wrote to memory of 4424	1452	Unicorn-32238.exe	105
PID 1452 wrote to memory of 4424	1452	Unicorn-32238.exe	105
PID 1452 wrote to memory of 4424	1452	Unicorn-32238.exe	105
PID 3468 wrote to memory of 3136	3468	Unicorn-60538.exe	106
PID 3468 wrote to memory of 3136	3468	Unicorn-60538.exe	106
PID 3468 wrote to memory of 3136	3468	Unicorn-60538.exe	106
PID 1288 wrote to memory of 2532	1288	Unicorn-32503.exe	108
PID 1288 wrote to memory of 2532	1288	Unicorn-32503.exe	108
PID 1288 wrote to memory of 2532	1288	Unicorn-32503.exe	108
PID 1172 wrote to memory of 3612	1172	Unicorn-52601.exe	107
PID 1172 wrote to memory of 3612	1172	Unicorn-52601.exe	107
PID 1172 wrote to memory of 3612	1172	Unicorn-52601.exe	107
PID 3100 wrote to memory of 3940	3100	Unicorn-50877.exe	109
PID 3100 wrote to memory of 3940	3100	Unicorn-50877.exe	109
PID 3100 wrote to memory of 3940	3100	Unicorn-50877.exe	109
PID 2484 wrote to memory of 3668	2484	Unicorn-6929.exe	111

C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Fareit.VB.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Fareit.VB.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21047.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21047.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37879.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57805.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56063.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
        9⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18915.exe
        10⤵
        
        PID:17808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17509.exe
        9⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        8⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        8⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        8⤵
        
        PID:19088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        7⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        7⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        7⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44735.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65262.exe
        8⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        8⤵
        
        PID:17344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35360.exe
        7⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52673.exe
        7⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28124.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62178.exe
        7⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        6⤵
        
        PID:10616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
        6⤵
        
        PID:16684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10504.exe
        6⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44911.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13193.exe
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27335.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        9⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        9⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
        9⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        9⤵
        
        PID:18444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9879.exe
        8⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        8⤵
        
        PID:17492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22072.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2516.exe
        8⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        8⤵
        
        PID:19572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29897.exe
        7⤵
        
        PID:15596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        6⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        8⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15200.exe
        8⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        8⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27015.exe
        7⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        7⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        6⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        7⤵
        
        PID:17868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
        6⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exe
        6⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        5⤵
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        6⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6694.exe
        8⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        9⤵
        
        PID:17988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18469.exe
        8⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        8⤵
        
        PID:16324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        7⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        7⤵
        
        PID:19164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7381.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        7⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
        7⤵
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        7⤵
        
        PID:17352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        7⤵
        
        PID:18452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43149.exe
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        6⤵
        
        PID:16148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41905.exe
        6⤵
        
        PID:19048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        5⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        6⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
        7⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        6⤵
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37144.exe
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51642.exe
        5⤵
        
        PID:13592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58080.exe
        5⤵
        
        PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36264.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42031.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41647.exe
        8⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26095.exe
        9⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
        10⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        10⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        9⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37192.exe
        9⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
        9⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23992.exe
        8⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60343.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12593.exe
        9⤵
        
        PID:17036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19604.exe
        8⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        8⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60785.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-749.exe
        8⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25563.exe
        9⤵
        
        PID:18984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19604.exe
        8⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32881.exe
        8⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        8⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18040.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        8⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        8⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34204.exe
        7⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
        7⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
        6⤵
        Executes dropped EXE
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16266.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        8⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exe
        9⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44593.exe
        9⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        9⤵
        
        PID:18500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29221.exe
        8⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49304.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        8⤵
        
        PID:18812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19237.exe
        7⤵
        
        PID:13408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13408 -s 220
        8⤵
        Program crash
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        7⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34687.exe
        8⤵
        
        PID:16776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        8⤵
        
        PID:19396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8073.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        6⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        6⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12342.exe
        6⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12470.exe
        9⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        9⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35360.exe
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
        8⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20943.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        7⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50910.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17351.exe
        7⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38978.exe
        8⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
        8⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        8⤵
        
        PID:18768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        7⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-788.exe
        7⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        7⤵
        
        PID:18916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36982.exe
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11044.exe
        6⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        6⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        5⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        7⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12470.exe
        8⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        8⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        7⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43845.exe
        7⤵
        
        PID:15684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        7⤵
        
        PID:17304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54769.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
        6⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exe
        5⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21378.exe
        6⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        7⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        7⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        6⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        6⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34576.exe
        5⤵
        
        PID:13620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        5⤵
        
        PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44349.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17911.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11081.exe
        6⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15113.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        8⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53119.exe
        9⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        9⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43653.exe
        8⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46714.exe
        8⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        7⤵
        
        PID:13960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        7⤵
        
        PID:17500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
        7⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59647.exe
        8⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        8⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        8⤵
        
        PID:19296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        7⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29663.exe
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65345.exe
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        6⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7853.exe
        5⤵
        
        PID:208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        6⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51199.exe
        8⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        8⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        8⤵
        
        PID:18556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27015.exe
        7⤵
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41693.exe
        6⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37005.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        6⤵
        
        PID:16952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18882.exe
        6⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        7⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57082.exe
        6⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43705.exe
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44184.exe
        5⤵
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
        5⤵
        
        PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44070.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10313.exe
        5⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29442.exe
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49667.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        7⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
        7⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        6⤵
        
        PID:13804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        6⤵
        
        PID:19280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12757.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
        6⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        7⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
        6⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        6⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29972.exe
        5⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54385.exe
        5⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        5⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57466.exe
        5⤵
        
        PID:19320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
      4⤵
      PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49535.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        6⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        6⤵
        
        PID:16952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        6⤵
        
        PID:19308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        5⤵
        
        PID:17176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40587.exe
        5⤵
        
        PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16389.exe
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        5⤵
        
        PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
      4⤵
      PID:10480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
      4⤵
      PID:15464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46608.exe
      4⤵
      PID:17124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
      4⤵
      PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exe
        7⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe
        9⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37375.exe
        10⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        9⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
        9⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        9⤵
        
        PID:18436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
        8⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53912.exe
        8⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22209.exe
        8⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63326.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        8⤵
        
        PID:19240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39509.exe
        7⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38579.exe
        7⤵
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
        6⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
        8⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        8⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47774.exe
        7⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
        7⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43897.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        6⤵
        
        PID:12948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56451.exe
        6⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
        6⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27143.exe
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        8⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        8⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        8⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
        7⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
        7⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57378.exe
        7⤵
        
        PID:17728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20920.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34880.exe
        8⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17509.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        7⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32968.exe
        6⤵
        
        PID:19136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exe
        6⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59834.exe
        7⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43049.exe
        7⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63710.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8463.exe
        6⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        6⤵
        
        PID:17820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59647.exe
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        6⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        6⤵
        
        PID:18748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe
        5⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42435.exe
        5⤵
        
        PID:19152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44911.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55103.exe
        6⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
        7⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        8⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25957.exe
        8⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe
        8⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49677.exe
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        7⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
        6⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2973.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        7⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        7⤵
        
        PID:19024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        6⤵
        
        PID:14528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        5⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37063.exe
        7⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        8⤵
        
        PID:17168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43049.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        7⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
        7⤵
        
        PID:17160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        7⤵
        
        PID:19012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        6⤵
        
        PID:19120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
        5⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32642.exe
        6⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
        7⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        7⤵
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        7⤵
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22209.exe
        6⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        5⤵
        
        PID:15428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62024.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12425.exe
        5⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8777.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
        8⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        8⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        7⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38579.exe
        6⤵
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29472.exe
        5⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        6⤵
        
        PID:15324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        6⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17208.exe
        5⤵
        
        PID:19064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
      4⤵
      PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18882.exe
        5⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
        6⤵
        
        PID:11932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35962.exe
        6⤵
        
        PID:19408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe
        5⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        5⤵
        
        PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18504.exe
      4⤵
      PID:8252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
      4⤵
      PID:12884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
      4⤵
      PID:1244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24751.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        8⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        8⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        8⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3824.exe
        7⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        7⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42786.exe
        7⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45050.exe
        7⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        7⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24591.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        6⤵
        
        PID:16308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41905.exe
        6⤵
        
        PID:19360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28015.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        7⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44593.exe
        7⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        7⤵
        
        PID:18804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        6⤵
        
        PID:10680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32775.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        6⤵
        
        PID:18936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        5⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
        6⤵
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        6⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        6⤵
        
        PID:18548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36710.exe
        5⤵
        
        PID:11376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
        5⤵
        
        PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        6⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50239.exe
        7⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        7⤵
        
        PID:17292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10113.exe
        7⤵
        
        PID:17064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56585.exe
        6⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        5⤵
        
        PID:10032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        5⤵
        
        PID:15284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21080.exe
        5⤵
        
        PID:17832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47610.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        6⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34687.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22033.exe
        7⤵
        
        PID:18780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        6⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3824.exe
        5⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12593.exe
        6⤵
        
        PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        5⤵
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        5⤵
        
        PID:19184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3328.exe
      4⤵
      PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23031.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        5⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6420.exe
      4⤵
      PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
        5⤵
        
        PID:17896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29693.exe
      4⤵
      PID:14744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49721.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
        5⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51839.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
        7⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        7⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        7⤵
        
        PID:18928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        6⤵
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6888.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        6⤵
        
        PID:11440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        6⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
        5⤵
        
        PID:10744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        5⤵
        
        PID:16100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41905.exe
        5⤵
        
        PID:18948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
      4⤵
      PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3510.exe
        5⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15200.exe
        6⤵
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        5⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52673.exe
        5⤵
        
        PID:16692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38048.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38024.exe
      4⤵
      PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        5⤵
        
        PID:13920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        5⤵
        
        PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42870.exe
      4⤵
      PID:11156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
      4⤵
      PID:2596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
      4⤵
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28015.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18469.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        6⤵
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7228.exe
        5⤵
        
        PID:15016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        5⤵
        
        PID:16852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
      4⤵
      PID:7392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30844.exe
      4⤵
      PID:11352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
      4⤵
      PID:14656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
      4⤵
      PID:14736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
    3⤵
    PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
      4⤵
      PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45366.exe
        5⤵
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        5⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        5⤵
        
        PID:18760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
      4⤵
      PID:10348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46522.exe
      4⤵
      PID:4676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19121.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
      4⤵
      PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
      4⤵
      PID:15480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
      4⤵
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
    3⤵
    PID:10752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
    3⤵
    PID:17048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
    3⤵
    PID:1736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12305.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36655.exe
        7⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16951.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        9⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        10⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        9⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        9⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        8⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        8⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        8⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17354.exe
        9⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        9⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        9⤵
        
        PID:19248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        8⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9916.exe
        8⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
        7⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42938.exe
        8⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33628.exe
        7⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40587.exe
        7⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        6⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        8⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        9⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
        9⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61784.exe
        8⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        8⤵
        
        PID:17308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        7⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18882.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
        8⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58334.exe
        7⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28935.exe
        7⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        7⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39648.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        6⤵
        
        PID:14540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28880.exe
        6⤵
        
        PID:19232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51154.exe
        6⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        7⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        8⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        8⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41905.exe
        8⤵
        
        PID:19112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42744.exe
        7⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        7⤵
        
        PID:14092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
        6⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        7⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        8⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        7⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6231.exe
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        6⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        5⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27335.exe
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        7⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        7⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        7⤵
        
        PID:17288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
        6⤵
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        6⤵
        
        PID:19072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1785.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        6⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        6⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64661.exe
        5⤵
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
        5⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
        5⤵
        
        PID:17016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37816.exe
        5⤵
        
        PID:18488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37122.exe
        6⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        8⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52405.exe
        9⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        8⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        8⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27285.exe
        7⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        7⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        7⤵
        
        PID:19264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        8⤵
        
        PID:18476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        7⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        7⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        6⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        6⤵
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        6⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59538.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
        8⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15200.exe
        8⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        8⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30943.exe
        7⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exe
        7⤵
        
        PID:17680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1607.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21349.exe
        6⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11709.exe
        5⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58619.exe
        6⤵
        
        PID:17656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9700.exe
        5⤵
        
        PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14074.exe
        5⤵
        
        PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12055.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        6⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14281.exe
        7⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
        7⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:19384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54385.exe
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2708.exe
        6⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
        5⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
        5⤵
        
        PID:14256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42435.exe
        5⤵
        
        PID:19376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33967.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62026.exe
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        6⤵
        
        PID:12808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        6⤵
        
        PID:17268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        5⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11910.exe
        6⤵
        
        PID:13808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4425.exe
        6⤵
        
        PID:17248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24230.exe
        5⤵
        
        PID:14516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exe
      4⤵
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35839.exe
        5⤵
        
        PID:13504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12593.exe
        5⤵
        
        PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57041.exe
      4⤵
      PID:10380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        5⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46730.exe
        5⤵
        
        PID:18796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe
      4⤵
      PID:15376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52601.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10313.exe
        6⤵
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45970.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        8⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
        9⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        9⤵
        
        PID:17648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        8⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64369.exe
        8⤵
        
        PID:17124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        8⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        7⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
        7⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        6⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63287.exe
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18818.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
        8⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        7⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        7⤵
        
        PID:17048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51146.exe
        7⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31038.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
        6⤵
        
        PID:14692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        6⤵
        
        PID:19100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18901.exe
        5⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        7⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25855.exe
        8⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
        8⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        7⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        7⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45433.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14908.exe
        6⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
        6⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19855.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22455.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        6⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        5⤵
        
        PID:9184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
        5⤵
        
        PID:14708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        5⤵
        
        PID:19556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16493.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10313.exe
        5⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30703.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        7⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
        8⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
        8⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        8⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45833.exe
        7⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        7⤵
        
        PID:16872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        6⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39576.exe
        6⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        7⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        7⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        7⤵
        
        PID:19564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18536.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        6⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        6⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        5⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28542.exe
        5⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25943.exe
        5⤵
        
        PID:16348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        5⤵
        
        PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47328.exe
      4⤵
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        6⤵
        
        PID:19368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33439.exe
        5⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        5⤵
        
        PID:17460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1792.exe
      4⤵
      PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        5⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        5⤵
        
        PID:19000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49456.exe
      4⤵
      PID:10500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
      4⤵
      PID:15568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
      4⤵
      PID:19584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13110.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        6⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53626.exe
        7⤵
        
        PID:17336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
        6⤵
        
        PID:17220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        5⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4416.exe
        5⤵
        
        PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        5⤵
        
        PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50687.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        6⤵
        
        PID:15332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44321.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
        5⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8765.exe
        5⤵
        
        PID:16204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
      4⤵
      PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59886.exe
        5⤵
        
        PID:14112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27200.exe
        5⤵
        
        PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33534.exe
      4⤵
      PID:10060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
      4⤵
      PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
      4⤵
      PID:19032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35326.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        5⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        6⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32378.exe
        7⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40176.exe
        6⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        6⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        5⤵
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        5⤵
        
        PID:18540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
      4⤵
      PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30265.exe
      4⤵
      PID:11544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
      4⤵
      PID:8
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
    3⤵
    PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
      4⤵
      PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
        5⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        5⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        5⤵
        
        PID:16300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61784.exe
      4⤵
      PID:12452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
      4⤵
      PID:3188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36093.exe
    3⤵
    PID:8028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34735.exe
    3⤵
    PID:10848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52745.exe
    3⤵
    PID:2652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55378.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8777.exe
        7⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14278.exe
        8⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        8⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        8⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28052.exe
        7⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
        7⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40587.exe
        7⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        6⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51002.exe
        7⤵
        
        PID:12844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12844 -s 468
        8⤵
        Program crash
        
        PID:14276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12844 -s 420
        8⤵
        Program crash
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32310.exe
        6⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27296.exe
        6⤵
        
        PID:19476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        6⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
        6⤵
        
        PID:17404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
        6⤵
        
        PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3440.exe
        5⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38429.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
        5⤵
        
        PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64823.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
        8⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        7⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        7⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21997.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        6⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
        6⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        5⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
        6⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19604.exe
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
        5⤵
        
        PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15149.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        5⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1785.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        5⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9916.exe
        5⤵
        
        PID:15408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
        5⤵
        
        PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58965.exe
      4⤵
      PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
      4⤵
      PID:10884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
      4⤵
      PID:16188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
      4⤵
      PID:19176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3129.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33548.exe
        6⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56480.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        5⤵
        
        PID:14456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
        5⤵
        
        PID:18512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
      4⤵
      PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        5⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52087.exe
        6⤵
        
        PID:16140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
        6⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe
        5⤵
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9916.exe
        5⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        5⤵
        
        PID:18568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
      4⤵
      PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        5⤵
        
        PID:13460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        5⤵
        
        PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
      4⤵
      PID:5460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53856.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
        5⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21378.exe
        6⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
        7⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
        7⤵
        
        PID:17096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
        7⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
        6⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27669.exe
        5⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53912.exe
        5⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
        5⤵
        
        PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
      4⤵
      PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44671.exe
        5⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        5⤵
        
        PID:14044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
      4⤵
      PID:11528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
      4⤵
      PID:17184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
      4⤵
      PID:4072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
    3⤵
    PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44271.exe
        5⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        5⤵
        
        PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
      4⤵
      PID:9448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30559.exe
      4⤵
      PID:13816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe
      4⤵
      PID:17708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59624.exe
    3⤵
    PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
      4⤵
      PID:11332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
      4⤵
      PID:13072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe
      4⤵
      PID:4504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-269.exe
    3⤵
    PID:10988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exe
    3⤵
    PID:17072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11521.exe
    3⤵
    PID:4436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16650.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40319.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        8⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4152.exe
        8⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        8⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        7⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
        7⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exe
        7⤵
        
        PID:19608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1785.exe
        7⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        7⤵
        
        PID:15348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        7⤵
        
        PID:18992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19604.exe
        6⤵
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32881.exe
        6⤵
        
        PID:17140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        6⤵
        
        PID:16980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62622.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        6⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46207.exe
        7⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        7⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 220
        8⤵
        Program crash
        
        PID:17844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        6⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
        6⤵
        
        PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        5⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36183.exe
        5⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
        5⤵
        
        PID:17480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65274.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14278.exe
        7⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        7⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        7⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2096.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        6⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25353.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        5⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36031.exe
        6⤵
        
        PID:13436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4425.exe
        6⤵
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        5⤵
        
        PID:16228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
        5⤵
        
        PID:17512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        6⤵
        
        PID:13204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52885.exe
        6⤵
        
        PID:17000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
        5⤵
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53912.exe
        5⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
        5⤵
        
        PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51761.exe
      4⤵
      PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18615.exe
        5⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        5⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
        5⤵
        
        PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16804.exe
      4⤵
      PID:10904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58080.exe
      4⤵
      PID:464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50239.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        7⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17109.exe
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24410.exe
        6⤵
        
        PID:17048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
        5⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
        5⤵
        
        PID:888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28984.exe
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62026.exe
        5⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47665.exe
        5⤵
        
        PID:12728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        5⤵
        
        PID:17240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15447.exe
      4⤵
      PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59777.exe
      4⤵
      PID:13716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
      4⤵
      PID:17096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5911.exe
    3⤵
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58938.exe
      4⤵
      PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
        5⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        5⤵
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        5⤵
        
        PID:18972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19797.exe
      4⤵
      PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
      4⤵
      PID:15160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41865.exe
    3⤵
    PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
      4⤵
      PID:11392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
      4⤵
      PID:17244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
      4⤵
      PID:17740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
    3⤵
    PID:10776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe
    3⤵
    PID:15668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
      4⤵
      PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30151.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        6⤵
        
        PID:18520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18536.exe
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        5⤵
        
        PID:14800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        5⤵
        
        PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
      4⤵
      PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        5⤵
        
        PID:10520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        5⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
        5⤵
        
        PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41120.exe
      4⤵
      PID:10892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exe
      4⤵
      PID:13660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20053.exe
    3⤵
    PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-749.exe
      4⤵
      PID:7604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        5⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
        5⤵
        
        PID:15140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        5⤵
        
        PID:16896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
      4⤵
      PID:10924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
      4⤵
      PID:16324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
      4⤵
      PID:17956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
    3⤵
    PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1785.exe
      4⤵
      PID:9412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
      4⤵
      PID:15356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
      4⤵
      PID:19256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
    3⤵
    PID:10932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41023.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15017.exe
      4⤵
      PID:6240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
    3⤵
    PID:16176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18929.exe
    3⤵
    PID:19464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10697.exe
    3⤵
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27335.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22455.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        5⤵
        
        PID:14564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        5⤵
        
        PID:18732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
      4⤵
      PID:10956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57957.exe
      4⤵
      PID:17112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40779.exe
      4⤵
      PID:1508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6888.exe
    3⤵
    PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
      4⤵
      PID:10216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
      4⤵
      PID:14548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
      4⤵
      PID:19548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
    3⤵
    PID:10736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
    3⤵
    PID:15660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58225.exe
    3⤵
    PID:17664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
  2⤵
  PID:4064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28015.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
      4⤵
      PID:10164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19704.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
      4⤵
      PID:19272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
    3⤵
    PID:10580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24031.exe
    3⤵
    PID:15608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
  2⤵
  PID:7424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
    3⤵
    PID:11404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59314.exe
    3⤵
    PID:18824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exe
  2⤵
  PID:6496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20850.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20850.exe
  2⤵
  PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 13408 -ip 13408
1⤵
PID:14240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 12844 -ip 12844
1⤵
PID:14104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 12844 -ip 12844
1⤵
PID:16296

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4716 -ip 4716
1⤵
PID:5656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12305.exe

Filesize
468KB

MD5
b8ca04d3932f51c31001720d368fc81c

SHA1
6cbf317a3832f2276215113dcd2561268c459da9

SHA256
d834ecfa50d2874f8b7498d6ce419c74992a8d23b4c93d1fac0529c9955b383b

SHA512
d312e5973b4b3a7118e3400c958cf32f4efdc1f7f076b5d102d876914382f64a94c66e3b7fcbf6a8a0151d0990f70a6386f74cf4b49ccf026801221b527b5dfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16650.exe

Filesize
468KB

MD5
0367eba29e992aeb51cdbd8a91434c8f

SHA1
1e095ea520451bb3b58eec407671918d919d4f2b

SHA256
b7a246c2b4c484b3edafeee60bb1e2ca73f8d44649a9975967ce94bdb6faeeb6

SHA512
2d1119c49dc2f14a7dcafe345e2407bdaf5c5e1247ccabd9ee913309bb6e77e495ef07a1c073e39e3c7016399ab251ca49a82d08a8bece8fad1ab93b69e385a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17911.exe

Filesize
468KB

MD5
8100d91830f0446c8286b66a27e14438

SHA1
c76a977f5ab95bb7128b12ce6e8f11995c46a4e1

SHA256
333654a417911400c76fda738de9b64e3b147ad3467a9d3ff61be494cc640a7b

SHA512
b9af4c86b7410886ad01bd498b9c3c08b209615bdec5baf10e17c184f21b02aa5e191f2d8e71104732a346778280915fb4b43f8c584d618bb97df1ff44e6cf47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21047.exe

Filesize
468KB

MD5
ab9c487a04b399267adf26fe7276e983

SHA1
55c538f303a7bf556bc405524e838d352cee9b6b

SHA256
e43184abb115e7873650ab3386c91bd4ec4b20abe44c69ed5754c740bab10dfc

SHA512
c79b06583b0222dd58e0b4074e9fd88635ec4e5d85ffbe31eb8c78ff8d40fd1658b622742912c36e978da55b4051448b2030c8a0d1e935346e729be29ced6efc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe

Filesize
468KB

MD5
e1aef1accce4c200792abccd5c36a323

SHA1
7ec2cecaeec40a22c414c0c068d042ee34cf5cda

SHA256
2dea9f01975ac2cacea7a24b8d1c2f3016909e2454743e088dad29255d12552e

SHA512
c8b4c3061ed4f1f9ea87879ca34cc38d6d8b3b04a15237039b293325fb9b7fcd61505c6d85833e658e8fd1d5cacc4e674f8bd4c5d524bd21fa2e9b169da88299

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe

Filesize
468KB

MD5
24043be3567f5ae7949cb9835c4611ac

SHA1
96d5ef2aa5aa4622fcf6526b87e7d2bd5c666372

SHA256
0856e6620f8e2e64590789f789a71cce42470645ebbe53d69216a28730b802e1

SHA512
0f229183a6773e8d131d536a47f5eb8c0815673c11ba0353e4054becd59ab95a069c596d7c5146b97135581c49db5217887e2cdb8a68f4bbe708440c03e2e8dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe

Filesize
468KB

MD5
f63fdb2d878a7f2e3a026a0b7f110839

SHA1
8f9af594db3313c984ff3e1a0a2d9c630ead7822

SHA256
05ab406c08c0f961be17bfe5d565ed8d41246e3a3eb0c7c5080bed8d762c81cd

SHA512
6c05363f8f641c0a5923da997d9728f51cd41699a33c77aebcbb97efd943e2889ac0ce06a8d5ad860d7aa3e734b2cb8fe33fe5a041d3f215f8ed10f80cf7af60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe

Filesize
468KB

MD5
f3548ff6633fcd64bb5910a4afd4d49d

SHA1
3d433b7d18dc5d0f5362917db39fb27c73a9984c

SHA256
33605b48c4e0ee2227a168c20f866637f2f17ebcda5b089aabe96f69ef7ab1d6

SHA512
4c636b85af41a2e5aec2dba9ad0ceb68d403843ce68dd320f719b91a6ea6f88e138b8d2682bb4fb7b9bb77c1e268457dae852c1a74595d80efccaa46790ff288

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe

Filesize
468KB

MD5
a720d9cc18f1e9584b8ba6437c271127

SHA1
e84f6d5e19ca00072915ac36faed689b15c8b1f0

SHA256
4883022c73f9dcaf0edf0e19395bdbb1f70062e40cdedee1fbf3a1ab18e08136

SHA512
b8e50cd6a98563792ffc63b293b63e5c93ca629c6cc27a8f09264eb05a9087d2e3135db775235965390e5a81fbacb80ed1e60566d945abf848ae4da69f5d631e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36264.exe

Filesize
468KB

MD5
86ca3b04c14ca2fe4ca056d1e70ee853

SHA1
3bf2885a89a6c6527e803db65b3e0a03da88306b

SHA256
9dfd59729cee62543a26d67461906e3dc1377b63f1f9d5e64f78f4ade2a89139

SHA512
d08aa8594d89f404922169bfdddccf35d4e9c7b5d2571e0d414187c5608a4f253d949e0d939dd99c839ed67cece40a6bf0032382aa578a80364da78e18ec9882

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37879.exe

Filesize
468KB

MD5
56e7e76b9ab43f13bad9bdee63c9796c

SHA1
f194538fd4b032da99eb1afdc288348aa2c0706e

SHA256
135b4ceacf04ce4927e97e5ef21a2c04cb8e8da45f7373f50adf66d8441f4ffc

SHA512
32cd666378ed1c7c1d823a0de28b97d02a8f412266f13ca7e5ea277c23770579bef5637e85c4af47fa51aea8ce214e70d8133eb767742b65a7b8298a3f66e007

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38024.exe

Filesize
468KB

MD5
acd0dcebfdcf161f86cf588bd748517d

SHA1
74cc0d1ded05305d1961edc68d345c7cb90990be

SHA256
5836dd7b0a0cc97c89d48ce7f9f5d6551fed98b9e756a56b04d23787eba9142c

SHA512
632450584e3b6e6a4caea633feaf3502f1468f021cead0d3fbb56ba7a3c96759f2dea92acceffc8eb04e7f2bb479032b8edee4a3671f950b578db40bc63986ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe

Filesize
468KB

MD5
7cb3729d98e1247a6868dbb588b38890

SHA1
611322461a295a98290b0cef716dee4c1c35ea30

SHA256
a2ee2e59a0b5a81b577f0bfd95279cf1d50ce190b42a0b12210ad87836013677

SHA512
6f5a7adde329f399c457614786a153b9eef198714bcf31a6704229f01fd5b060978e2341911b47a857f1fd4b3c8e172618624a471aa41414e465587c4ac5d98e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe

Filesize
468KB

MD5
c0942d1894a3d7952347b6cf5f3d4500

SHA1
8ef5cddc37ec818fe90e95f42cfc4b5c444ed900

SHA256
709d7cc0f3e98e66395509c7c0e3e84c554617777508a55713bbc642f135c365

SHA512
4129a21c00e91cf2bdc1345f0da11094b83d732dadbca2c078f238196422d3f4c78108eb4c5afa0bcd929c5abf0072ced75ddce69c03cf003b1910d81c5d4922

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42031.exe

Filesize
468KB

MD5
90881117c97eb7e0c243e22330185718

SHA1
71d12cf615dac0da2aa7023171b8b837e35bd3d4

SHA256
7bfa0f835524b06aca236231ba9a20fab88636730d83f16b6c67d512cead2422

SHA512
9bb6db9a25e3ee2388f787b80310f1f7588720658b1d05a7a7cdf3d3b6bc97dd1a2290ff7c4d559dd07aa8783c0c75081146095a774c5a71d4232d7874338a55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe

Filesize
468KB

MD5
d60f7ae14c6c3c73cd94bb17772c1c23

SHA1
13698e9dfb334c057b0f93eb7dc01ba06a59e09a

SHA256
ca0d6cb9d76dbe4f1033764f603fc09a100ce3fa30c9e8ee405ba982e4523d6f

SHA512
c37b47a2756caae3d5e30d347eeba0c6dd49683b03615c2f410c31ad8506b1318704244b67202195408cd77d32b9d483e5ae564ac0084d0bc27b0080994d4628

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44349.exe

Filesize
468KB

MD5
9bfe310111ecc326b649b7642d2fc4ce

SHA1
2cad9ae0f15c06ffd904ff185131fddc676c0161

SHA256
9386c78b9c4612d4a506ce90cdf293a8c1a27e71588450ab2a1b4cfadef0d2df

SHA512
2aa8176df3284f6a0a6a78375ea996054fdf65e7396134d3f9e0cd71c5ba7831f7c445c388b74a5e13fe117c151e44160503cc34aa725264c6a163716a857fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe

Filesize
468KB

MD5
e5639edc60e87fd474c85b4bbc6b9891

SHA1
97aad9c1f4fba32e2dfb8b533b98ffe5d798214a

SHA256
e6995e517405e78609e1f63ea7040d8452c96c273c741136294babcc12c268b9

SHA512
33cfbc5498d8b69f25e0f2bc5d755aebfa1eccd47dcd7f9231739ddb779166e1396c6fd6fe8896abecdcf93c1eb0f29f8abb43a2963cd6cb44efdabfb88e567a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49721.exe

Filesize
468KB

MD5
57ba9ac73483151f84cdded6afc4f506

SHA1
0f3359a1bd0ab4c05526cc45c9e51013b072f64f

SHA256
99a5174becb13958e605ff0a85de761073dda81bdb52de8d4d55ef9185ebc1db

SHA512
df33854acf5f4bb9b073e8ee9cf71ea4a230b8d6670e5e0778d70232df0ad4f4d727e11b8e36355b4a7b55bb8f4de99305aa9263db1896c19ca278e9a0dce995

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe

Filesize
468KB

MD5
c92f6b25364c013330e01f6fc2ea96bf

SHA1
c352a7e63aff3df5af2cd11e6ca9656f61a0e42c

SHA256
9c9d5e5f3858b3bad2688dd94a695743b4ec693c1f7cee8ce69947e967dcb3cf

SHA512
f507fbf5a142c1a63873e06fc2001671975afa8fccdf4ec83b90f40dcc365930a95e9df936c35924904541a1019f94044b8da44670d5b5296dd297241c009c90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe

Filesize
468KB

MD5
a4db6317870e77386d580de69762313f

SHA1
ea68c25a11e39440ee24a0dd2fe89e80bb4d13da

SHA256
99cfe61511ee156b4cbc3f794675cb1176ed9b06faa313b574c859c6102358bb

SHA512
9ed98ef91757e13eebf5515447e585d61bb743ab282949f6da27c738754f55d94d6c343b0ac46587c7b93a7411696562403e7d4832d8b4d02a919b02ccce2864

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe

Filesize
468KB

MD5
754a18778f87be449f2dd6d8a2121dd5

SHA1
bf209332fecdd3c58729fc8f9645a487157fb797

SHA256
95fa5a7d9e197cb05b4752175ae3a88aa72a1135dea587e5f3d8c26876eca763

SHA512
3cc2f9f7d2a961d39c17bd02f972b5d43142b0cd0d51225844313f27e8cf46bf04ea5c97863c0a4e56f6a977af8a679df8e510640bf297e066c97c1ac91ac617

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52601.exe

Filesize
468KB

MD5
3fff8d322895387bb56329323dbf6f41

SHA1
ce6f5ac98e81d4d60d4bfa9ac6303d452fbc3d9b

SHA256
e6b6f6c36456aa4fa527ac5c546ca08be22dcc7b2861ff20b094abe431a74764

SHA512
2d009895c8af92f54ea6648be9b46fad70b3df32ad9bd0141a0749a2c969aef78ae7254e077698a3db01ba1fca45d6f25f93f1412c48bf49750bf73c5e72f563

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe

Filesize
468KB

MD5
f2507dad6c086a3de043b9a4f4855784

SHA1
dc9a62f1af9d36c3376ef1213b6611f80699a75a

SHA256
8272a8a6c1d0a9e902ab3c458bf5cc08d0325f38e7d85efa7d47e58c5fcf6dd8

SHA512
4befeb9fd2cf6805cbaad39fdf538873f5195704764ff2c93846ab787689f1fa9aa767a719703b691c7162b8c679ee0285e94eabc165aedaa8eeb7f370caca1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe

Filesize
468KB

MD5
19c4cb509331e3b0273859f040b3e7a5

SHA1
71ab49bdda8fd9f951398b4a58e6e03eab7f3e64

SHA256
81c954fa32d8162edb54e4872be0fb439839e526dad6b7dd37e2592dd5007d56

SHA512
2e2b7d68885ac642cefa55c5372dd4511fb42190f03cbe8937f9b3201f40db1df0a89bae3f09f5f66ffbe6c26da9755ee40b884e8c9e4b7c8ef52f8fddb5ecb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe

Filesize
468KB

MD5
c6fa2a3b95754554a191847eac105722

SHA1
12b2c15acc657f52979eb276471a7aaea8679197

SHA256
d943ed4116eab68c6a0529d4632dc1c53deb0e44b9d59cb8ffe900f155b8cc7a

SHA512
94c6af7541721d546c22edb902bebff574b1ba40caba41ba6408fb29b8178e3d5d1186641ebd3001a56208172c11ad373f814f8b812120e11fa2a8e85edc1d25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe

Filesize
468KB

MD5
3f0f546f660de68e70699d6ca18b8f0c

SHA1
c2ba44d824a7f4f9ac9006fe7f5d91ac2a1bbc58

SHA256
aea48bb57c3c3e847571d2da4b3ce2efda20b19e3fa790377eabd0801d7bcae3

SHA512
d2542036a196f919426f32b8935b32f76608dd313512d71aa3a9082439d67c6810f1902a153218bff150a907d04a0484fd0ba6c1320319474073ca631d5cab10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe

Filesize
468KB

MD5
c5ad74ad2d93cde7afe0013c5458e089

SHA1
f49a06073f5cd0bf2a1e33ecad3c0b43e323143e

SHA256
a9378a746a62ab58b4db7641ee77020fe0d49080569e01ace3e92e73aecb435a

SHA512
c7cc8cd8d862c394233cbd95cf8c669ae584fd4fe567288e51617cde22261fce5c1b5a0acde05bea22f3ea34c04ee4c8f3e23a5e90ae7cce82448f5bf882281a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe

Filesize
468KB

MD5
8fe8b83e43e2f753373029d739d2d482

SHA1
a9b496203c9c628e288866ca9ead5230c4b1861d

SHA256
1963c1879331b30369966ec4bf9a1eca953ec1c0a2ea33e27017d46b7d8bfa21

SHA512
2c1f3a34cf30d15c9da2f4d2f61e29a627a82fc730d53b2d903c55a8ac748936ee8c1b5f4e9c25d1935ff4f21702b577558397afd6fe9d180b4fba9d9d2a8857

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe

Filesize
468KB

MD5
96d9a64f9a6c271f7ca65956d2e1022e

SHA1
a5207a2e717a6eb72f4ea06df3d171de387a8599

SHA256
251414bc8215af98e1456245f71e80b6b932f845352040494d070d71dbf867d3

SHA512
6ffd888b534d8102c81537d8b1f7d14b27c7548167abab4e19a275699221a8c8519a806018b9914cd9037fe82296559def9ae36bbb34e197ffc789d1238173d9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads