4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4

Analysis

max time kernel
108s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe
Size

468KB
MD5

1a7d1885c14e60f38be06fd33fbdae50
SHA1

fef586c34af8f200972e6375b34a528bf0464ba5
SHA256

4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4
SHA512

d3b9ef3ed9cb310c3d20cc51f3b558f95ada21f686ae2612e4d571da3cbe75fceec99033115b9a1edeb387560a5f7c1bb814604a56b1a1e0bf96bd08292e70cf
SSDEEP

3072:vKC6ov2uU35/MbY7PgJ5wf8/E5ilLVXnlmHd8SGTdvuwqfHuMalW:vKbooJ/MAPQ5wfY1MUdvTgHuM

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4136	Unicorn-20793.exe
2684	Unicorn-5416.exe
4432	Unicorn-51088.exe
2292	Unicorn-33110.exe
2376	Unicorn-39241.exe
4380	Unicorn-15291.exe
4124	Unicorn-20527.exe
4048	Unicorn-22687.exe
4340	Unicorn-52956.exe
3228	Unicorn-64082.exe
4028	Unicorn-43007.exe
4392	Unicorn-25209.exe
3880	Unicorn-19078.exe
400	Unicorn-54988.exe
968	Unicorn-54988.exe
4548	Unicorn-56379.exe
3224	Unicorn-52295.exe
3760	Unicorn-43862.exe
2680	Unicorn-44127.exe
1720	Unicorn-44127.exe
3324	Unicorn-37997.exe
3276	Unicorn-24261.exe
864	Unicorn-35196.exe
3492	Unicorn-53639.exe
456	Unicorn-53639.exe
4680	Unicorn-60416.exe
4468	Unicorn-14479.exe
2312	Unicorn-16691.exe
2088	Unicorn-16691.exe
1812	Unicorn-41287.exe
1808	Unicorn-37011.exe
2004	Unicorn-63561.exe
1180	Unicorn-15683.exe
5052	Unicorn-17075.exe
3280	Unicorn-6860.exe
4596	Unicorn-43525.exe
3768	Unicorn-39441.exe
2668	Unicorn-61999.exe
3060	Unicorn-1723.exe
4452	Unicorn-7323.exe
1428	Unicorn-53831.exe
2528	Unicorn-53566.exe
1584	Unicorn-45663.exe
2644	Unicorn-17437.exe
5024	Unicorn-14936.exe
2488	Unicorn-25797.exe
3204	Unicorn-1730.exe
856	Unicorn-48377.exe
2156	Unicorn-65381.exe
3396	Unicorn-63343.exe
4772	Unicorn-24449.exe
4360	Unicorn-20365.exe
4532	Unicorn-51091.exe
3700	Unicorn-12004.exe
4200	Unicorn-22865.exe
436	Unicorn-38647.exe
1264	Unicorn-3571.exe
4120	Unicorn-6529.exe
2972	Unicorn-26130.exe
2992	Unicorn-17464.exe
4640	Unicorn-57121.exe
1560	Unicorn-33171.exe
3148	Unicorn-33171.exe
4464	Unicorn-33171.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
10464	9628	WerFault.exe	623
16644	13988	WerFault.exe	726
16704	14820	WerFault.exe	722
16668	13928	WerFault.exe	739
16496	1684	WerFault.exe	731

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3125.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3964	dwm.exe
Token: SeChangeNotifyPrivilege	3964	dwm.exe
Token: 33	3964	dwm.exe
Token: SeIncBasePriorityPrivilege	3964	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe
4136	Unicorn-20793.exe
2684	Unicorn-5416.exe
4432	Unicorn-51088.exe
2292	Unicorn-33110.exe
4380	Unicorn-15291.exe
2376	Unicorn-39241.exe
4124	Unicorn-20527.exe
4028	Unicorn-43007.exe
4048	Unicorn-22687.exe
3228	Unicorn-64082.exe
4340	Unicorn-52956.exe
4392	Unicorn-25209.exe
3880	Unicorn-19078.exe
400	Unicorn-54988.exe
968	Unicorn-54988.exe
4548	Unicorn-56379.exe
3224	Unicorn-52295.exe
864	Unicorn-35196.exe
1720	Unicorn-44127.exe
3276	Unicorn-24261.exe
2680	Unicorn-44127.exe
3760	Unicorn-43862.exe
3324	Unicorn-37997.exe
456	Unicorn-53639.exe
4680	Unicorn-60416.exe
3492	Unicorn-53639.exe
4468	Unicorn-14479.exe
2312	Unicorn-16691.exe
2088	Unicorn-16691.exe
1812	Unicorn-41287.exe
1808	Unicorn-37011.exe
2004	Unicorn-63561.exe
1180	Unicorn-15683.exe
5052	Unicorn-17075.exe
3280	Unicorn-6860.exe
4596	Unicorn-43525.exe
3768	Unicorn-39441.exe
3060	Unicorn-1723.exe
1428	Unicorn-53831.exe
2668	Unicorn-61999.exe
4452	Unicorn-7323.exe
2644	Unicorn-17437.exe
2528	Unicorn-53566.exe
5024	Unicorn-14936.exe
1584	Unicorn-45663.exe
3204	Unicorn-1730.exe
2488	Unicorn-25797.exe
856	Unicorn-48377.exe
2156	Unicorn-65381.exe
3396	Unicorn-63343.exe
4772	Unicorn-24449.exe
4360	Unicorn-20365.exe
4532	Unicorn-51091.exe
3700	Unicorn-12004.exe
1264	Unicorn-3571.exe
4200	Unicorn-22865.exe
4120	Unicorn-6529.exe
2972	Unicorn-26130.exe
2992	Unicorn-17464.exe
436	Unicorn-38647.exe
4464	Unicorn-33171.exe
4640	Unicorn-57121.exe
1560	Unicorn-33171.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 4136	2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe	84
PID 2996 wrote to memory of 4136	2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe	84
PID 2996 wrote to memory of 4136	2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe	84
PID 4136 wrote to memory of 2684	4136	Unicorn-20793.exe	88
PID 4136 wrote to memory of 2684	4136	Unicorn-20793.exe	88
PID 4136 wrote to memory of 2684	4136	Unicorn-20793.exe	88
PID 2996 wrote to memory of 4432	2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe	87
PID 2996 wrote to memory of 4432	2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe	87
PID 2996 wrote to memory of 4432	2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe	87
PID 2996 wrote to memory of 2292	2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe	90
PID 2996 wrote to memory of 2292	2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe	90
PID 2996 wrote to memory of 2292	2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe	90
PID 4432 wrote to memory of 2376	4432	Unicorn-51088.exe	91
PID 4432 wrote to memory of 2376	4432	Unicorn-51088.exe	91
PID 4432 wrote to memory of 2376	4432	Unicorn-51088.exe	91
PID 4136 wrote to memory of 4380	4136	Unicorn-20793.exe	92
PID 4136 wrote to memory of 4380	4136	Unicorn-20793.exe	92
PID 4136 wrote to memory of 4380	4136	Unicorn-20793.exe	92
PID 2684 wrote to memory of 4124	2684	Unicorn-5416.exe	95
PID 2684 wrote to memory of 4124	2684	Unicorn-5416.exe	95
PID 2684 wrote to memory of 4124	2684	Unicorn-5416.exe	95
PID 2292 wrote to memory of 4048	2292	Unicorn-33110.exe	96
PID 2292 wrote to memory of 4048	2292	Unicorn-33110.exe	96
PID 2292 wrote to memory of 4048	2292	Unicorn-33110.exe	96
PID 2996 wrote to memory of 4340	2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe	97
PID 2996 wrote to memory of 4340	2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe	97
PID 2996 wrote to memory of 4340	2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe	97
PID 4432 wrote to memory of 3228	4432	Unicorn-51088.exe	98
PID 4432 wrote to memory of 3228	4432	Unicorn-51088.exe	98
PID 4432 wrote to memory of 3228	4432	Unicorn-51088.exe	98
PID 4136 wrote to memory of 4028	4136	Unicorn-20793.exe	99
PID 4136 wrote to memory of 4028	4136	Unicorn-20793.exe	99
PID 4136 wrote to memory of 4028	4136	Unicorn-20793.exe	99
PID 4124 wrote to memory of 4392	4124	Unicorn-20527.exe	100
PID 4124 wrote to memory of 4392	4124	Unicorn-20527.exe	100
PID 4124 wrote to memory of 4392	4124	Unicorn-20527.exe	100
PID 2684 wrote to memory of 3880	2684	Unicorn-5416.exe	101
PID 2684 wrote to memory of 3880	2684	Unicorn-5416.exe	101
PID 2684 wrote to memory of 3880	2684	Unicorn-5416.exe	101
PID 2376 wrote to memory of 400	2376	Unicorn-39241.exe	102
PID 2376 wrote to memory of 400	2376	Unicorn-39241.exe	102
PID 2376 wrote to memory of 400	2376	Unicorn-39241.exe	102
PID 4380 wrote to memory of 968	4380	Unicorn-15291.exe	103
PID 4380 wrote to memory of 968	4380	Unicorn-15291.exe	103
PID 4380 wrote to memory of 968	4380	Unicorn-15291.exe	103
PID 4028 wrote to memory of 4548	4028	Unicorn-43007.exe	104
PID 4028 wrote to memory of 4548	4028	Unicorn-43007.exe	104
PID 4028 wrote to memory of 4548	4028	Unicorn-43007.exe	104
PID 4340 wrote to memory of 3224	4340	Unicorn-52956.exe	105
PID 4340 wrote to memory of 3224	4340	Unicorn-52956.exe	105
PID 4340 wrote to memory of 3224	4340	Unicorn-52956.exe	105
PID 4136 wrote to memory of 3760	4136	Unicorn-20793.exe	106
PID 4136 wrote to memory of 3760	4136	Unicorn-20793.exe	106
PID 4136 wrote to memory of 3760	4136	Unicorn-20793.exe	106
PID 3228 wrote to memory of 2680	3228	Unicorn-64082.exe	107
PID 3228 wrote to memory of 2680	3228	Unicorn-64082.exe	107
PID 3228 wrote to memory of 2680	3228	Unicorn-64082.exe	107
PID 4048 wrote to memory of 1720	4048	Unicorn-22687.exe	108
PID 4048 wrote to memory of 1720	4048	Unicorn-22687.exe	108
PID 4048 wrote to memory of 1720	4048	Unicorn-22687.exe	108
PID 4432 wrote to memory of 3324	4432	Unicorn-51088.exe	109
PID 4432 wrote to memory of 3324	4432	Unicorn-51088.exe	109
PID 4432 wrote to memory of 3324	4432	Unicorn-51088.exe	109
PID 2996 wrote to memory of 864	2996	4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe	110

C:\Users\Admin\AppData\Local\Temp\4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe
"C:\Users\Admin\AppData\Local\Temp\4d7a3e48d3125b040ba88d92b3930070393e9e10c88d1690d460eeb7722815b4N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20793.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20793.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5416.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20527.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53639.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        8⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        9⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
        9⤵
        
        PID:18240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        8⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        8⤵
        
        PID:18304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57955.exe
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36177.exe
        8⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
        8⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
        8⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        7⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exe
        7⤵
        
        PID:17444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38045.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32481.exe
        8⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
        9⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23198.exe
        9⤵
        
        PID:18868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        8⤵
        
        PID:16076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
        8⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34644.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        7⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        7⤵
        
        PID:18948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        6⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        8⤵
        
        PID:19276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        7⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exe
        7⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35528.exe
        6⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:19920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46785.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16591.exe
        6⤵
        
        PID:18248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7126.exe
        7⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43769.exe
        9⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        10⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20411.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-369.exe
        10⤵
        
        PID:19832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62710.exe
        9⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24091.exe
        9⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        8⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exe
        8⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42465.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exe
        8⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
        8⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
        7⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        8⤵
        
        PID:20316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        7⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        7⤵
        
        PID:18748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        6⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32119.exe
        8⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58481.exe
        9⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65144.exe
        9⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        9⤵
        
        PID:18312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51636.exe
        8⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        8⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:20136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
        7⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        7⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
        7⤵
        
        PID:18624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57955.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38123.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
        7⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        6⤵
        
        PID:14556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65381.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        6⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53203.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        8⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38274.exe
        9⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        8⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        8⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        7⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6414.exe
        7⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        7⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        6⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
        7⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28257.exe
        7⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe
        7⤵
        
        PID:18384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        6⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34314.exe
        6⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        6⤵
        
        PID:19856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
        5⤵
        
        PID:728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3312.exe
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
        7⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
        7⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        6⤵
        
        PID:13336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55155.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55227.exe
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22419.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9284.exe
        6⤵
        
        PID:17456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        5⤵
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        5⤵
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19078.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53639.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        8⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        8⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exe
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        7⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        7⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31026.exe
        7⤵
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
        6⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
        7⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        7⤵
        
        PID:18888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
        6⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47905.exe
        7⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55440.exe
        7⤵
        
        PID:18684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        6⤵
        
        PID:19424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        5⤵
        Executes dropped EXE
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42129.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63208.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        8⤵
        
        PID:17564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        7⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
        7⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe
        7⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18012.exe
        6⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34055.exe
        7⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11008.exe
        7⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
        6⤵
        
        PID:12504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
        6⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37343.exe
        5⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
        6⤵
        
        PID:16040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        6⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11215.exe
        5⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35352.exe
        5⤵
        
        PID:11204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59544.exe
        5⤵
        
        PID:16172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        5⤵
        
        PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20365.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29493.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        8⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        9⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45170.exe
        9⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59554.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        8⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        8⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        8⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60660.exe
        7⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
        7⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56472.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
        7⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        7⤵
        
        PID:18224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        6⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18243.exe
        6⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        6⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
        7⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        6⤵
        
        PID:18756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37473.exe
        5⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        6⤵
        
        PID:16360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        6⤵
        
        PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60930.exe
        5⤵
        
        PID:11464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56493.exe
        5⤵
        
        PID:18936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29877.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32481.exe
        6⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        7⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        7⤵
        
        PID:13988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13988 -s 464
        8⤵
        Program crash
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        7⤵
        
        PID:17912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        6⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        5⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56407.exe
        5⤵
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        5⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
        6⤵
        
        PID:17992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        5⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exe
        5⤵
        
        PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
      4⤵
      PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe
        5⤵
        
        PID:18408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exe
      4⤵
      PID:12628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7976.exe
      4⤵
      PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54988.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16691.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51091.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29493.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        8⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        9⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exe
        9⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41272.exe
        9⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        8⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
        8⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62777.exe
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        7⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        7⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51062.exe
        7⤵
        
        PID:18256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31007.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63208.exe
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-339.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        7⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        7⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:19880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
        6⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        6⤵
        
        PID:12188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7014.exe
        6⤵
        
        PID:17868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2632.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53219.exe
        8⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        8⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
        8⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        7⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30508.exe
        7⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55113.exe
        7⤵
        
        PID:18208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        6⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        7⤵
        
        PID:20340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17924.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55964.exe
        6⤵
        
        PID:16236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        6⤵
        
        PID:18804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        6⤵
        
        PID:9548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61314.exe
        6⤵
        
        PID:13488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        6⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62362.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20526.exe
        5⤵
        
        PID:13960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55678.exe
        5⤵
        
        PID:19296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41287.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24449.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49389.exe
        8⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        9⤵
        
        PID:20324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
        8⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
        8⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14111.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        7⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        7⤵
        
        PID:17860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20945.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32394.exe
        6⤵
        
        PID:13536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7640.exe
        6⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe
        7⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52171.exe
        7⤵
        
        PID:19892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63809.exe
        6⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10830.exe
        5⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46342.exe
        6⤵
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34480.exe
        5⤵
        
        PID:11412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
        5⤵
        
        PID:14244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29850.exe
        5⤵
        
        PID:18972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7510.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        7⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exe
        7⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        6⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44745.exe
        6⤵
        
        PID:17984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14007.exe
        5⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
        6⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15149.exe
        6⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        5⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:19364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-910.exe
      4⤵
      PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        5⤵
        
        PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        5⤵
        
        PID:14820
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14820 -s 464
        6⤵
        Program crash
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57284.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63062.exe
      4⤵
      PID:7628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32375.exe
      4⤵
      PID:11636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4508.exe
      4⤵
      PID:16344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36770.exe
      4⤵
      PID:19820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63561.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38647.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        8⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
        9⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47713.exe
        10⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4786.exe
        10⤵
        
        PID:18232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        9⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        8⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56383.exe
        8⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe
        8⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
        8⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44750.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        7⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24060.exe
        7⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-262.exe
        7⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        7⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25246.exe
        7⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50275.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59918.exe
        6⤵
        
        PID:14012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63447.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
        8⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        7⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        7⤵
        
        PID:16180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        7⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59621.exe
        6⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
        7⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        7⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30773.exe
        7⤵
        
        PID:17424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        6⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8178.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38341.exe
        6⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49965.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53167.exe
        8⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        8⤵
        
        PID:18352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        7⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22543.exe
        7⤵
        
        PID:19064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49690.exe
        6⤵
        
        PID:11384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        6⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
        6⤵
        
        PID:18984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-333.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61969.exe
        5⤵
        
        PID:12652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63794.exe
        5⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe
        5⤵
        
        PID:17960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15683.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57121.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56519.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63447.exe
        7⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        8⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
        8⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35242.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
        7⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        7⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        6⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48725.exe
        7⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exe
        7⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24914.exe
        6⤵
        
        PID:11800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13028.exe
        6⤵
        
        PID:19928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        6⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        6⤵
        
        PID:16508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21110.exe
        5⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40007.exe
        6⤵
        
        PID:10552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65144.exe
        6⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
        6⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-324.exe
        5⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57284.exe
        5⤵
        
        PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
      4⤵
      PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        6⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
        5⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40639.exe
        6⤵
        
        PID:16208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52455.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59341.exe
        5⤵
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        5⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13028.exe
        5⤵
        
        PID:19908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
        5⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        5⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        5⤵
        
        PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57205.exe
      4⤵
      PID:8724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45433.exe
      4⤵
      PID:12636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56173.exe
      4⤵
      PID:18272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14936.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28725.exe
        5⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        6⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26691.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        8⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36996.exe
        8⤵
        
        PID:18288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        7⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        7⤵
        
        PID:16368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        7⤵
        
        PID:18880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        6⤵
        
        PID:11764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24060.exe
        6⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30303.exe
        6⤵
        
        PID:18264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27140.exe
        5⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        6⤵
        
        PID:19268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        5⤵
        
        PID:13528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38080.exe
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14889.exe
      4⤵
      PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50505.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        6⤵
        
        PID:15944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        6⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9399.exe
        5⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
        5⤵
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56493.exe
        5⤵
        
        PID:18900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
      4⤵
      PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44563.exe
        5⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        5⤵
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32747.exe
        5⤵
        
        PID:19204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
      4⤵
      PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46203.exe
        5⤵
        
        PID:11908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53250.exe
        5⤵
        
        PID:17136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        5⤵
        
        PID:17948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41549.exe
      4⤵
      PID:12560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
      4⤵
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
      4⤵
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26753.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20302.exe
        6⤵
        
        PID:19188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11267.exe
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40841.exe
        5⤵
        
        PID:12848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
        5⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        5⤵
        
        PID:18928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31775.exe
      4⤵
      PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11672.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        5⤵
        
        PID:13708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24592.exe
      4⤵
      PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe
      4⤵
      PID:13544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
      4⤵
      PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1791.exe
      4⤵
      PID:6580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
    3⤵
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42897.exe
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17921.exe
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        5⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        5⤵
        
        PID:18740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
      4⤵
      PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64769.exe
      4⤵
      PID:12644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
    3⤵
    PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
      4⤵
      PID:11268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43542.exe
      4⤵
      PID:16640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
    3⤵
    PID:10080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22779.exe
    3⤵
    PID:14248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32480.exe
    3⤵
    PID:6832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39241.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54988.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16691.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        6⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53203.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9534.exe
        8⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5507.exe
        8⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40815.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        8⤵
        
        PID:19404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        7⤵
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe
        6⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        7⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48678.exe
        7⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exe
        6⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
        6⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
        7⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        7⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
        7⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
        6⤵
        
        PID:16532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe
        6⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48408.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3312.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
        6⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe
        6⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        5⤵
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39761.exe
        5⤵
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe
        5⤵
        
        PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62357.exe
        6⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
        8⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        8⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        7⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24094.exe
        7⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exe
        7⤵
        
        PID:18368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        6⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
        6⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1459.exe
        5⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45419.exe
        6⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        7⤵
        
        PID:13744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        6⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
        6⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57955.exe
        5⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2736.exe
        6⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42415.exe
        7⤵
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19176.exe
        7⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        6⤵
        
        PID:13612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe
        6⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52824.exe
        5⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        6⤵
        
        PID:20332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53583.exe
        5⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60831.exe
        5⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26130.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        6⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        7⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39637.exe
        7⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        7⤵
        
        PID:19440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20142.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46680.exe
        5⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        6⤵
        
        PID:14812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
        6⤵
        
        PID:18392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64987.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        5⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
        5⤵
        
        PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48549.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17921.exe
        5⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        6⤵
        
        PID:19372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26338.exe
        5⤵
        
        PID:14224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
      4⤵
      PID:8896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
      4⤵
      PID:11324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
      4⤵
      PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64082.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        6⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        8⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        8⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        8⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        7⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        7⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
        6⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9534.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        7⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
        7⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65241.exe
        6⤵
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35414.exe
        6⤵
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17366.exe
        6⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe
        5⤵
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        7⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
        7⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8050.exe
        7⤵
        
        PID:18296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        7⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exe
        7⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-623.exe
        7⤵
        
        PID:18320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7546.exe
        6⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        6⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        7⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10291.exe
        7⤵
        
        PID:18916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34146.exe
        6⤵
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26976.exe
        5⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39411.exe
        5⤵
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        5⤵
        
        PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25797.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8112.exe
        5⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36591.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        7⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36617.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57546.exe
        7⤵
        
        PID:19076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31775.exe
        5⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19321.exe
        5⤵
        
        PID:9916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        5⤵
        
        PID:16024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
        5⤵
        
        PID:17968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2056.exe
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
        6⤵
        
        PID:12976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36177.exe
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13879.exe
        6⤵
        
        PID:20244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
        5⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        5⤵
        
        PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
      4⤵
      PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        5⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11729.exe
        5⤵
        
        PID:13824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
        5⤵
        
        PID:19672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2550.exe
      4⤵
      PID:9560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3991.exe
      4⤵
      PID:13948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22473.exe
      4⤵
      PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61999.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-136.exe
        5⤵
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
        6⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15809.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        8⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
        8⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58594.exe
        8⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        7⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        8⤵
        
        PID:19468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        7⤵
        
        PID:16188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exe
        6⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27023.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        7⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59554.exe
        7⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exe
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55964.exe
        6⤵
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24885.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25246.exe
        6⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32062.exe
        6⤵
        
        PID:19172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6380.exe
        5⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59544.exe
        5⤵
        
        PID:16156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        5⤵
        
        PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57868.exe
      4⤵
      PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
        5⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17785.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        6⤵
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        6⤵
        
        PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        5⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        5⤵
        
        PID:12572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
      4⤵
      PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62989.exe
        5⤵
        
        PID:14960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
      4⤵
      PID:10072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
      4⤵
      PID:14276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40218.exe
      4⤵
      PID:4492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10250.exe
      4⤵
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38429.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24797.exe
        7⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3354.exe
        7⤵
        
        PID:20144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56488.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        6⤵
        
        PID:17380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
        6⤵
        
        PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        5⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30495.exe
        5⤵
        
        PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
      4⤵
      PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        5⤵
        
        PID:7604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        5⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4952.exe
        5⤵
        
        PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14696.exe
      4⤵
      PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exe
        5⤵
        
        PID:12872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45819.exe
        5⤵
        
        PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
      4⤵
      PID:12220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18051.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe
    3⤵
    PID:832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
        5⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        5⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        5⤵
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11267.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40841.exe
      4⤵
      PID:12856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exe
      4⤵
      PID:18816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30067.exe
    3⤵
    PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
      4⤵
      PID:15764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
      4⤵
      PID:18196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21746.exe
    3⤵
    PID:10064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
    3⤵
    PID:14268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46261.exe
    3⤵
    PID:18400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33110.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33110.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45663.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28725.exe
        6⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37573.exe
        8⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55803.exe
        9⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
        9⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 444
        10⤵
        Program crash
        
        PID:16496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
        9⤵
        
        PID:18336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59612.exe
        8⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        7⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62706.exe
        7⤵
        
        PID:17360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        6⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17127.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exe
        8⤵
        
        PID:17796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        6⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        6⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe
        6⤵
        
        PID:18376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        5⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12362.exe
        6⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58761.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        7⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19918.exe
        7⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40047.exe
        6⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10333.exe
        6⤵
        
        PID:13512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-838.exe
        6⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55817.exe
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        6⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        6⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
        5⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51253.exe
        5⤵
        
        PID:14024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17437.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        5⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe
        6⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        7⤵
        
        PID:13304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        6⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34314.exe
        6⤵
        
        PID:13652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        5⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44921.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        6⤵
        
        PID:14448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22543.exe
        6⤵
        
        PID:18676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3588.exe
        5⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40218.exe
        5⤵
        
        PID:17316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6066.exe
      4⤵
      PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53203.exe
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        6⤵
        
        PID:13752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42761.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
        5⤵
        
        PID:13996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
      4⤵
      PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47443.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26170.exe
        5⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21693.exe
        5⤵
        
        PID:19940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21792.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
      4⤵
      PID:13440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61752.exe
      4⤵
      PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24261.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17075.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7728.exe
        5⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60733.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-380.exe
        8⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42726.exe
        8⤵
        
        PID:17104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        8⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        7⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        7⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        7⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9181.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        7⤵
        
        PID:18176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        6⤵
        
        PID:11288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        6⤵
        
        PID:15888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
        5⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        6⤵
        
        PID:11644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
        6⤵
        
        PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4774.exe
        5⤵
        
        PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48076.exe
        5⤵
        
        PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17660.exe
        5⤵
        
        PID:18280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
      4⤵
      PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
        6⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35269.exe
        7⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36498.exe
        7⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4302.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        6⤵
        
        PID:16908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe
        6⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46488.exe
        5⤵
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41251.exe
        5⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        5⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61653.exe
        5⤵
        
        PID:19356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
      4⤵
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        5⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61594.exe
      4⤵
      PID:9124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17236.exe
      4⤵
      PID:12240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5216.exe
      4⤵
      PID:452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59643.exe
      4⤵
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7702.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60707.exe
        6⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
        7⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        8⤵
        
        PID:19432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        7⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        7⤵
        
        PID:19952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19726.exe
        6⤵
        
        PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-961.exe
        5⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        5⤵
        
        PID:18644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
      4⤵
      PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
        5⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27153.exe
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64624.exe
        6⤵
        
        PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exe
        5⤵
        
        PID:11852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
        5⤵
        
        PID:17192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47521.exe
        5⤵
        
        PID:18344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
      4⤵
      PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
      4⤵
      PID:9628
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9628 -s 216
        5⤵
        Program crash
        
        PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
      4⤵
      PID:5420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36628.exe
    3⤵
    PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63125.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        5⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62710.exe
        5⤵
        
        PID:11408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42477.exe
        5⤵
        
        PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50162.exe
      4⤵
      PID:9080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49009.exe
      4⤵
      PID:12768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27734.exe
      4⤵
      PID:17196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61222.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34542.exe
    3⤵
    PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9534.exe
      4⤵
      PID:9608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
      4⤵
      PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51552.exe
    3⤵
    PID:9528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
    3⤵
    PID:13968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62780.exe
    3⤵
    PID:5168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52295.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43525.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34371.exe
        5⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        7⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
        7⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        6⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        6⤵
        
        PID:14472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29874.exe
        6⤵
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56815.exe
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29649.exe
        7⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19560.exe
        7⤵
        
        PID:18424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24465.exe
        6⤵
        
        PID:18360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51837.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
        5⤵
        
        PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe
      4⤵
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60733.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34615.exe
        7⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe
        7⤵
        
        PID:13928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13928 -s 464
        8⤵
        Program crash
        
        PID:16668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63411.exe
        7⤵
        
        PID:19248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        6⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        6⤵
        
        PID:16144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44745.exe
        6⤵
        
        PID:17928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        5⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33977.exe
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exe
        6⤵
        
        PID:15436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exe
        6⤵
        
        PID:19048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        5⤵
        
        PID:11368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        5⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3291.exe
      4⤵
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
        5⤵
        
        PID:11188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exe
        5⤵
        
        PID:964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-919.exe
      4⤵
      PID:11476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26039.exe
      4⤵
      PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52027.exe
      4⤵
      PID:17728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
      4⤵
      PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        5⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exe
        5⤵
        
        PID:12388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23197.exe
        5⤵
        
        PID:18192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
      4⤵
      PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        5⤵
        
        PID:16080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55056.exe
        5⤵
        
        PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
      4⤵
      PID:11688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
      4⤵
      PID:13576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29850.exe
      4⤵
      PID:19036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
    3⤵
    PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43089.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60899.exe
        5⤵
        
        PID:7984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        5⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        5⤵
        
        PID:19448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
      4⤵
      PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:19416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
      4⤵
      PID:14176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
    3⤵
    PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
      4⤵
      PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
      4⤵
      PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35414.exe
    3⤵
    PID:9280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26741.exe
    3⤵
    PID:13700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18773.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:18584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39441.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
      4⤵
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46789.exe
        5⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        6⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
        7⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        7⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57416.exe
        7⤵
        
        PID:19224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        6⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
        6⤵
        
        PID:18992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46680.exe
        5⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        6⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exe
        5⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55964.exe
        5⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21943.exe
        5⤵
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23031.exe
      4⤵
      PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46483.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
        5⤵
        
        PID:16048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16982.exe
        5⤵
        
        PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
      4⤵
      PID:9076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
      4⤵
      PID:13804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exe
      4⤵
      PID:7064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
    3⤵
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40567.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62871.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        6⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39637.exe
        6⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        6⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52466.exe
        5⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37911.exe
        6⤵
        
        PID:19004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
        5⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        5⤵
        
        PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44158.exe
      4⤵
      PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10406.exe
        5⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        5⤵
        
        PID:18608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe
      4⤵
      PID:11348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
      4⤵
      PID:16204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
      4⤵
      PID:17136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
    3⤵
    PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
      4⤵
      PID:9644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
      4⤵
      PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
      4⤵
      PID:6380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11215.exe
    3⤵
    PID:9552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
    3⤵
    PID:11020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51220.exe
    3⤵
    PID:15192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
    3⤵
    PID:2448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
    3⤵
    PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62487.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10712.exe
        6⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43873.exe
        7⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19513.exe
        6⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41007.exe
        5⤵
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51915.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22633.exe
        5⤵
        
        PID:18592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
      4⤵
      PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60977.exe
        5⤵
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45248.exe
        5⤵
        
        PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17924.exe
      4⤵
      PID:11032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55964.exe
      4⤵
      PID:16304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
    3⤵
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
      4⤵
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13208.exe
        5⤵
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        5⤵
        
        PID:16696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38030.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:19748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
      4⤵
      PID:11272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
      4⤵
      PID:15936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44745.exe
      4⤵
      PID:17848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37911.exe
      4⤵
      PID:19056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
    3⤵
    PID:13556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
    3⤵
    PID:18416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
  2⤵
  PID:3596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53203.exe
    3⤵
    PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38123.exe
      4⤵
      PID:8756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
      4⤵
      PID:13728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42761.exe
    3⤵
    PID:9452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
    3⤵
    PID:13976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
    3⤵
    PID:772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
  2⤵
  PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
    3⤵
    PID:9244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
    3⤵
    PID:13932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37572.exe
    3⤵
    PID:18616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
  2⤵
  PID:10088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
  2⤵
  PID:14200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6882.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6882.exe
  2⤵
  PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9628 -ip 9628
1⤵
PID:12612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 13928 -ip 13928
1⤵
PID:17124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1684 -ip 1684
1⤵
PID:17308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 14820 -ip 14820
1⤵
PID:17276

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe

Filesize
468KB

MD5
02cf3e8c119e2d9da8dc1fabc52f43d3

SHA1
117541202e60180517a35641dd4fa988d6f60f42

SHA256
ad80fdc5c4751212840452745c390bd20df8a27d0b2ed1aec5404f1ec323deb9

SHA512
7a10b3fe5defcdc4e70c1c1fe6fb8239ff78bfa06c134af27be1e765f695f5e8b0d6e7723779b15d3ae5481d507fc0e16287ffaba488ab03fbd5fe457c527e49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe

Filesize
468KB

MD5
e35fc7889cde5b01d6abf2c7cb369d25

SHA1
9c86aae89a26aad5ba604b1c2e0d680e40c49975

SHA256
911ac6043a5dcb980691aa86a913f4f355f8292388ce708ae15ac3c0eb3a5fd6

SHA512
885a7a41361a4d702383ad76e458053141573f72cb8679224eebdd4e98a6e0198dfe68ecca3d332aed56b6886dc26da0c553768e78b490e4fa23e0eac46d2d7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15809.exe

Filesize
468KB

MD5
20451804062f8ae4157c601a29c79b0a

SHA1
1439bcaf0d64911cd4901af2c9ed8a1ecab19fa1

SHA256
6eeaadaeb3b413f10ba95699f206f083427cbacfb2f1345ed5ef130269b29119

SHA512
ebaaeae14109907e371914f6a77da55f477e5e57019a320efb79c19dbe025e57579a88696cc9314b202631b3f9209ab3b46ea7d55337bb76111e474d2f17fd7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16691.exe

Filesize
468KB

MD5
9a4d595cd7c8cec888b4f1ec96d64140

SHA1
687d859f9ac74b5c55c8525094a009b9b2fa5c79

SHA256
dd6259239ca1f2c5ac9afb1efe7d30a9fecaac6f0dab1f5d11bbad9a0ce34e46

SHA512
0122b29f6a7eed7bc441efda1f2454a9a07377f705b96b0bba9c840f5c61b1a0ad981588c819f6df6f93f8d790857e1f86ab59277ae52e608fd5805e5f80ab51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19078.exe

Filesize
468KB

MD5
25466ed027bb8ed399e1821f4f061ae3

SHA1
c6a42a52dbe26e96e52704e2a5329ffd56f93143

SHA256
7cd5649cd1a1c7a386803273f78e6146dd53d9a63595090023bec5a537953efd

SHA512
cdf9248c2c4161ae1279f6accfad0a51fba0e4e10d0fe0a41f5b4b21faff49aba2ddd285e639b7117bf50cd98beb0b887430a3a118afb9dd34d4629ac7a6ac42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20527.exe

Filesize
468KB

MD5
abe5de0dff21c9928403dcb1e850834c

SHA1
25cc6449060f4aa827c84eaf6e91e49baa82dd39

SHA256
de98856128d23cd495e8a0fc38277c72274f098f9e25fd68b33babf32ed67631

SHA512
95d2392e08438ac56e44a24257ecea28436bbc32b795668e7feed83d8763ce830d664411d999da59f4c1149ea60cf55bf9e3822b4a7750c24a2f7c222eeaadd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20793.exe

Filesize
468KB

MD5
09def434c3d23d6992c6e3544c3e063f

SHA1
191ad54dd6fcd37117ea27876b18bdcd9d8c9645

SHA256
0dbdc374733f23447120b1a0f0b260e5e9bbfc12ba13b375ebe54d968f62dd8d

SHA512
f5ac3921d1c54474bfb83f05f4d9e39b52f01c5133947fe04212f524e3168364ec0495e6991f38e454ec9e92861a95cd17cbc92dfc60cd4e07594a9387752cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe

Filesize
468KB

MD5
9b1b0117b50fb7d2067dae0f5284e340

SHA1
375efb71d9a304081f8ea8f7688b47f719dc3b61

SHA256
8de533e45ebbeccc3d86d27726656ce161e3fd17d9f06eeec3a0ff5a24761e40

SHA512
ba8cd398f2ec8d45d68e650ef57b08bc66124935aff7ca55083d1ca690acbac785f619e5a86b58e607dba313fdab61f58ca2c2b284642e7b2fac46dedb37f5d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24261.exe

Filesize
468KB

MD5
952c0a82c5d8bd3c8be1dc8cc9cd8449

SHA1
aad7f0339a6c8088d3daa3d04088a63665b0e186

SHA256
920f1617fcdefd66a480c2bea93f005cfff9bf5c95cce0e557753bbe098bc143

SHA512
583bd85c1cb15f269712916d747f872ae46b024a82e3222e3ac7dc415cf29ed7d163ef92da30fc20d358fdf399945f793098ab26cddcf926b0536ca4ad7d73b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe

Filesize
468KB

MD5
03c859fdeb9e638cfca0504a9d62589b

SHA1
0241869e8561307ade2b3763651fded0b51d5f53

SHA256
c60f608dcd8781d8acd52722d1372058c2315e2d33904dbb9a18438f3c451115

SHA512
b0170e7c3410e895706b7a154437f38dd46f820ca5207560538186a5552c8237fdf00b4e198780c0936ba49e723026e364317a204aa70e031a5cde99c4d07cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33110.exe

Filesize
468KB

MD5
ea675066e929b3ee6b737b9b49d14b68

SHA1
e483a8cae567c617299f1065809cbbb884556b64

SHA256
557929a0b2348c111c144d39de426220893066211f5675bc01514831ba77360a

SHA512
1ded2cc893a7f799741d768fab115c59b1f56ad085131c5466fbd298efc4fbf7987617556d932f2974c9802e4dff5b0cdac6c493530e32ca8ef4155b889b249a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe

Filesize
468KB

MD5
329a917984dfe203076d42415f79a765

SHA1
0d8b7d98fad9c0c200520b93757e808f780c3d00

SHA256
45ed414443eda4928ba984a3a4519ba7fd3785d311ea78011244ff4f6895462a

SHA512
479687faae4af214c383d23224d3260d9f9a196592b6789979bdc47fc0e681722045b6ced771391aaff2b60b61de2d7d09a05131c58810377473e0a76e4a9830

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe

Filesize
468KB

MD5
f30e337a6dddbe5ce6e939192069c617

SHA1
05b68df0acc905ca6f154c791864cc60b1d0658c

SHA256
49b4ab7cc949aabae5db4c42c4c8ff2f92d436b36208672d58622df90b31e005

SHA512
c80f0f6d207e3d0b1165c702f03208d33247cb6b6fdbc4590415e3fa7a1f0ae0d09f1ed85c5aea6866ea9816f6186fa5145c8695b2e28d7ce86eb4d749a6b13b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe

Filesize
468KB

MD5
d23e56e049d7024354c7ef20bd1e46ba

SHA1
85e1a9a67c1856f2f08f4aacab9dfe876cdbebb2

SHA256
f2fddfa0b7c1c686ac14b8ed920c7a0a1d8c41e7e9f209e1528a88b27a48a2bb

SHA512
a70db868fc718a6e3927ffad96dde38a9ee8baf01de25c52039c9551c52ef785b8083265e89a51f22ec6c637b8d746552602b3c2ccaf696ebc1ffd3e6cf2bcbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39241.exe

Filesize
468KB

MD5
8ed37bc7c3c88a218914bca7fb2af363

SHA1
756b739804bd3a3c93f1ce1a45cd4f7c3cf4e058

SHA256
549e46b34bd7db96ef078eca2e79e7ffc202d2385d7fd95feaae1f1026e7ec68

SHA512
f78fe3601bc4bafc725ae2ffa2e510534ab77a02e8e3e59a7c30c0fd9cd8fbca4ea15843b2b1c62bef87e7ed5cbe2ac571c2ea93b50e658ac61e3c77c2bc10e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe

Filesize
468KB

MD5
7588e930848f1a7ec1d8e456118d89d3

SHA1
25b8e5bc2aefd8c7582441eb0a62ae29fd8e3117

SHA256
5bb07a710e764049a81a2fc7eb57669deb5d07a42c6ddf8ace9c8cca102623ac

SHA512
fa9eec4e34ef30d70fe6bb1e5995ebf76d4b6060840332759d7a84a9a7a540223055c395636cd504092543a43b5d8eeab9635ff37fa4ae0ffc7e911f45352958

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41287.exe

Filesize
468KB

MD5
6d3238c7a28e635d6b06593534c514e8

SHA1
24c6a1d353f91cf0c57daf340ee205386f55b682

SHA256
d2891149bba60a6b83fdde1eac9a6be67307b80af3c6722f5e0c9e147ea13974

SHA512
32a9c8b0068638803ea0542771ac80e3c21f445d51ca5d09ed4615f76b5eb14a8348ab76bcaf58b71bb01e8d8f3fc61e2c6e42b9810b6598a6d50db4054a32c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe

Filesize
468KB

MD5
b716b475526c96616132358e475133dd

SHA1
c053b359234973431f8db3f600712395bbdb959f

SHA256
9386187e102ac7c2439aaa046f6248c5640764b1c08c4c3e1e53bf6262e46fb6

SHA512
87c2dad0d9147405fd078f55a5173df5c485bddc5bcf30e7eea8f9d714231c45d6450ba7044b328fc1819305a7b7641e25dca4c79cad34e2fb9baac7fbeeb991

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43525.exe

Filesize
468KB

MD5
55f55da95985888fe2cd58745666aab2

SHA1
cc7e32575cbaa858e1c93b772a07133466cb63d0

SHA256
20f6663690906976012edba0741446e447400df0614ad837c7fa51d40d0b0131

SHA512
ffa8e80996ad897e5d1bee1502fe137957441304a582325353bda2bbade7eccb9feba0a5121425409def5c812f7807dc79a11a92b47df40bfa37b1e9b6ff7975

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe

Filesize
468KB

MD5
97027e73238abc112174c820e8dbf6f6

SHA1
1d3a6c78aef9b453f11c2a37de52a82950ca7cee

SHA256
86da767d3c3722061ada0a8bb9f9b4c4134efb00e1741f1a9bdad4a1ccc0238f

SHA512
d43832e9b1cccd8c11780c65950d1d69389ecb4928c543fa2ceab83fb28b012d88a1cac6cfc2d7052bead08e1b3f9ff3bbb0b3d986ffe275d70e7ad3c724a159

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe

Filesize
468KB

MD5
003e2fe9c23fea5419607975bd3f16b7

SHA1
11360a64d3352cbdddd2424eec881971bc7a7093

SHA256
3a5716ee43cc63152b42ed07e6fdca7b957693f72809fe26fd8c447e20766b29

SHA512
7f44bacc687c76ab00f1bf197834fd123d53c67509bee9f01885a6c18316a925575ffa72edebabff43cf979f366d79d469679a0e33ac882ba99edaffdf5d45a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe

Filesize
468KB

MD5
16f86b833584e0395a284c3e8e4c0b3c

SHA1
cce4fafcc961895bd4c7a7f2e0c98f24abca316a

SHA256
e7d1915308a3eb294e16f79c628674ee8ab95f2f99bbc998934ca67fc168263d

SHA512
714bbd5b2df41d642b389c9ec1c67f82899979f4e7d0a37fef99e577d6b41d29536ed13583ca050d3f8386f08776a6559b5a65cd27b7603482fda2b3ec156d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe

Filesize
468KB

MD5
6eb5e0a83b96457b8b6ff1ef48770f08

SHA1
cb47875020a255c884fd77ac3acd48ea9503d976

SHA256
e875e0446dbc11f9b7fe524e3490994846052b81aea7a43a491eadcd1547b42a

SHA512
82367ec59c1c117c212570d588440cf079619f52e5c344fb067973471d72628471ef2be0d285d394af5ae8ff6ad087d12d9318b4ff8db2ca800eb4f9a4702991

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52295.exe

Filesize
468KB

MD5
45641cda10f7f6317dcf96efd5cd12cf

SHA1
ea785fa80b63b89a690af4b0be420e3c42228928

SHA256
2ccd3cc110308c9be786e7058f49d6e44766abc692e4becbf9c1936111987706

SHA512
9d716cb20440b1e236cf3cbdcb05578278763a5995122d2e49b77f56581f8e8601ccaf6bf9ab67d7f5180bf1611057386dc869bbbc998ec285e714b2771738fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe

Filesize
468KB

MD5
370f77e97bb4729aacce7385946d7592

SHA1
5445d4dd5f08a326075c7d2e26fb469a91372e18

SHA256
8846f239b1e49e3b8d72daef13679dacfb45f256cd84c7255ffda33371a45120

SHA512
ca221002b7128ce53d144880a53e813bb570704ab41e08af6982b0d6fe8550ae9193e64cbaa084c4adefdc3865ce90a9a848efad561d05cc11587ff38789894e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53639.exe

Filesize
468KB

MD5
37be4e874b475ed77fcfb127b1fa7fc5

SHA1
26e52173eb9b5fb80daed4d2b4b2621c22734152

SHA256
0d93f0652fb466f94837aacaccfae064519f591459a0cf6f466886f365e05ebd

SHA512
d1ed4cee28113ef60391c327b6271d6882682d40e7f90d89c8603b228b5c74d1eacb6131354bdb247855602b1db3bb121231cda20962360e0c91aa92cfb126a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5416.exe

Filesize
468KB

MD5
12e450d984a40ca5dabac8c2de61a7b1

SHA1
f2df7c5d7c55ebc6a76f941e5582c4b6416c318d

SHA256
716bae0cdb94252a0892de7819d800a91b22e98bde5afb9ae22b063a3d950645

SHA512
9adc4ce7508caada83c669d30a4118bb5292501686096929548232834df109d28c251ddf0b11203540c9dc6fc0fd28ef34dc0f98135b39f85891fe0a28cfbe87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54988.exe

Filesize
468KB

MD5
bc21fa0ceaa97ed2bff08fdbd6cbcd55

SHA1
d0879d95e60f9c97623e03bc4b325f2cbb9c49a9

SHA256
15c58ec5426fef6a80c6d96b4cafec34f2715f5708d5734af2edb4d7329b7b1b

SHA512
11db1c974bb6607cd64b6f35211c1db58368fd515fba7a47c495593b38d5bc7c602d25dfa0ab16cd84f9e62e6a70579c12c9980f052dfacb52f16779de70cdd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe

Filesize
468KB

MD5
c4c849b9fb05b88102d471726ac7c3e9

SHA1
24b7c5993d7ae1c60a905d2cc2cb1c4f4ac5a050

SHA256
835bb39a1c1959a328b66716cdc53178a6c73550e1ce59cbe9d723e259592c52

SHA512
999acc2c895abec5255a1eeb7389c93bc4f38380572029041157efbfdd26b324cc58af28a6a040b167e66ad0ffe6031ca9a5f370d822d36a830a1b68c143b583

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe

Filesize
468KB

MD5
4d4aa03a2feeba52fefa80aad694bd34

SHA1
0e9bca64ae26615eea25379b13cb2caa5edb4287

SHA256
b91bbc026828f1a8ca0a1c1716827d104f70985f25c47cbb9932ec44ec449715

SHA512
28e906d71742858681f75b0138575ae12ed52eac2ce085566bc74616098b250f9d16bf4ad035db651ade07f15302eb11fbe254a496189afd03d953618c20acd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63561.exe

Filesize
468KB

MD5
f82563db243b413013b4280d05421727

SHA1
fe21948e51367f4b83834f03cbb862348e1d1e8a

SHA256
dc8528eba3deb3ddc3b36f8d46aa7bef033764eabed900f957aa79d8e2573236

SHA512
2bb37ae862f37a0588bc758bd739a49ffebdb734aa728eb47ef4bbf3a30a96e37e26d3ac60d44cc9a27089601068c2e7fcba11e0489e6e62549ad7db391ba34b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64082.exe

Filesize
468KB

MD5
e4877c01f8bb3adbe65e652371df4179

SHA1
0524f70bed53c57248c8b56ebaac890a2f0a72bb

SHA256
e14fb72a0f3cc5bacb0528440093ad364375060508a5d61da55be033e50a03f5

SHA512
9c689cd610fd0e18c23be33eabff1253f2accecccb8a04fda4452e46abbf042e97ecf8d98cfa56119997851b3408b09d2d4f104cb749572fea45b1f3873e3eeb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads