b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153

Analysis

max time kernel
106s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe
Size

468KB
MD5

1fc87ff273ea31a615454a79e41c5c10
SHA1

76c8399053ef49b808b6ebf37f5ae752370ae73f
SHA256

b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153
SHA512

da67bdf92fc4f24c5b98b063a5a71a871c6d6f12bdb658625bfaaa389c566837e8c316ebbf48f3f70d760f68875688d1f5a371b976fed089d952956be37baa66
SSDEEP

3072:6VgBogXdSS5BtgYtPzkjOf8/iCetZnpsnbHhYEhNclGMyXSCkhE5:6VSo9GBtTPgjOfJpalcl/wSCk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1720	Unicorn-41285.exe
4904	Unicorn-38715.exe
4912	Unicorn-58581.exe
564	Unicorn-18893.exe
2896	Unicorn-60480.exe
2976	Unicorn-27061.exe
872	Unicorn-47573.exe
740	Unicorn-8.exe
4324	Unicorn-12260.exe
4020	Unicorn-32772.exe
2440	Unicorn-12260.exe
3504	Unicorn-8176.exe
3516	Unicorn-53848.exe
1252	Unicorn-7911.exe
2908	Unicorn-755.exe
636	Unicorn-60439.exe
716	Unicorn-60439.exe
5044	Unicorn-3646.exe
924	Unicorn-15899.exe
4004	Unicorn-30843.exe
976	Unicorn-11814.exe
452	Unicorn-15899.exe
4544	Unicorn-23802.exe
736	Unicorn-50709.exe
2424	Unicorn-117.exe
4072	Unicorn-52747.exe
544	Unicorn-24067.exe
3412	Unicorn-49947.exe
3568	Unicorn-117.exe
5048	Unicorn-48663.exe
3456	Unicorn-25219.exe
4632	Unicorn-15004.exe
3816	Unicorn-1269.exe
4560	Unicorn-29111.exe
3664	Unicorn-29857.exe
492	Unicorn-45639.exe
1172	Unicorn-45639.exe
2728	Unicorn-46194.exe
4928	Unicorn-42109.exe
2084	Unicorn-25603.exe
4012	Unicorn-56329.exe
3804	Unicorn-64497.exe
1912	Unicorn-38047.exe
3640	Unicorn-19573.exe
3200	Unicorn-37284.exe
1452	Unicorn-46215.exe
2712	Unicorn-48253.exe
1520	Unicorn-54383.exe
3388	Unicorn-63728.exe
1396	Unicorn-54383.exe
2972	Unicorn-54383.exe
1748	Unicorn-16043.exe
212	Unicorn-16043.exe
4680	Unicorn-17526.exe
1552	Unicorn-42685.exe
4380	Unicorn-35644.exe
5052	Unicorn-56421.exe
4044	Unicorn-36677.exe
4056	Unicorn-12727.exe
1432	Unicorn-32593.exe
1496	Unicorn-38523.exe
4920	Unicorn-32593.exe
1192	Unicorn-44388.exe
2864	Unicorn-283.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
6816	2172	WerFault.exe	158
9888	6596	WerFault.exe	266
9908	4196	WerFault.exe	427
9988	8732	WerFault.exe	418
3120	2856	WerFault.exe	990

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11487.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	13292	dwm.exe
Token: SeChangeNotifyPrivilege	13292	dwm.exe
Token: 33	13292	dwm.exe
Token: SeIncBasePriorityPrivilege	13292	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3328	b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe
1720	Unicorn-41285.exe
4912	Unicorn-58581.exe
4904	Unicorn-38715.exe
564	Unicorn-18893.exe
2896	Unicorn-60480.exe
2976	Unicorn-27061.exe
872	Unicorn-47573.exe
740	Unicorn-8.exe
4020	Unicorn-32772.exe
4324	Unicorn-12260.exe
3504	Unicorn-8176.exe
2440	Unicorn-12260.exe
3516	Unicorn-53848.exe
1252	Unicorn-7911.exe
2908	Unicorn-755.exe
636	Unicorn-60439.exe
716	Unicorn-60439.exe
5044	Unicorn-3646.exe
4004	Unicorn-30843.exe
452	Unicorn-15899.exe
4544	Unicorn-23802.exe
5048	Unicorn-48663.exe
924	Unicorn-15899.exe
544	Unicorn-24067.exe
3412	Unicorn-49947.exe
3568	Unicorn-117.exe
736	Unicorn-50709.exe
4072	Unicorn-52747.exe
2424	Unicorn-117.exe
976	Unicorn-11814.exe
3456	Unicorn-25219.exe
4632	Unicorn-15004.exe
3816	Unicorn-1269.exe
4560	Unicorn-29111.exe
3664	Unicorn-29857.exe
1172	Unicorn-45639.exe
492	Unicorn-45639.exe
2728	Unicorn-46194.exe
4928	Unicorn-42109.exe
2084	Unicorn-25603.exe
4012	Unicorn-56329.exe
3804	Unicorn-64497.exe
3640	Unicorn-19573.exe
1912	Unicorn-38047.exe
3200	Unicorn-37284.exe
1452	Unicorn-46215.exe
2712	Unicorn-48253.exe
1396	Unicorn-54383.exe
2972	Unicorn-54383.exe
4680	Unicorn-17526.exe
3388	Unicorn-63728.exe
1748	Unicorn-16043.exe
212	Unicorn-16043.exe
1552	Unicorn-42685.exe
1520	Unicorn-54383.exe
4380	Unicorn-35644.exe
5052	Unicorn-56421.exe
4044	Unicorn-36677.exe
4056	Unicorn-12727.exe
1496	Unicorn-38523.exe
4920	Unicorn-32593.exe
1432	Unicorn-32593.exe
1192	Unicorn-44388.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 1720	3328	b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe	82
PID 3328 wrote to memory of 1720	3328	b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe	82
PID 3328 wrote to memory of 1720	3328	b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe	82
PID 3328 wrote to memory of 4904	3328	b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe	85
PID 3328 wrote to memory of 4904	3328	b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe	85
PID 3328 wrote to memory of 4904	3328	b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe	85
PID 1720 wrote to memory of 4912	1720	Unicorn-41285.exe	86
PID 1720 wrote to memory of 4912	1720	Unicorn-41285.exe	86
PID 1720 wrote to memory of 4912	1720	Unicorn-41285.exe	86
PID 4912 wrote to memory of 564	4912	Unicorn-58581.exe	89
PID 4912 wrote to memory of 564	4912	Unicorn-58581.exe	89
PID 4912 wrote to memory of 564	4912	Unicorn-58581.exe	89
PID 1720 wrote to memory of 2896	1720	Unicorn-41285.exe	90
PID 1720 wrote to memory of 2896	1720	Unicorn-41285.exe	90
PID 1720 wrote to memory of 2896	1720	Unicorn-41285.exe	90
PID 4904 wrote to memory of 2976	4904	Unicorn-38715.exe	91
PID 4904 wrote to memory of 2976	4904	Unicorn-38715.exe	91
PID 4904 wrote to memory of 2976	4904	Unicorn-38715.exe	91
PID 3328 wrote to memory of 872	3328	b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe	92
PID 3328 wrote to memory of 872	3328	b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe	92
PID 3328 wrote to memory of 872	3328	b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe	92
PID 2896 wrote to memory of 740	2896	Unicorn-60480.exe	94
PID 2896 wrote to memory of 740	2896	Unicorn-60480.exe	94
PID 2896 wrote to memory of 740	2896	Unicorn-60480.exe	94
PID 564 wrote to memory of 4324	564	Unicorn-18893.exe	95
PID 564 wrote to memory of 4324	564	Unicorn-18893.exe	95
PID 564 wrote to memory of 4324	564	Unicorn-18893.exe	95
PID 1720 wrote to memory of 4020	1720	Unicorn-41285.exe	97
PID 1720 wrote to memory of 4020	1720	Unicorn-41285.exe	97
PID 1720 wrote to memory of 4020	1720	Unicorn-41285.exe	97
PID 872 wrote to memory of 2440	872	Unicorn-47573.exe	96
PID 872 wrote to memory of 2440	872	Unicorn-47573.exe	96
PID 872 wrote to memory of 2440	872	Unicorn-47573.exe	96
PID 2976 wrote to memory of 3504	2976	Unicorn-27061.exe	98
PID 2976 wrote to memory of 3504	2976	Unicorn-27061.exe	98
PID 2976 wrote to memory of 3504	2976	Unicorn-27061.exe	98
PID 4912 wrote to memory of 3516	4912	Unicorn-58581.exe	99
PID 4912 wrote to memory of 3516	4912	Unicorn-58581.exe	99
PID 4912 wrote to memory of 3516	4912	Unicorn-58581.exe	99
PID 4904 wrote to memory of 2908	4904	Unicorn-38715.exe	101
PID 4904 wrote to memory of 2908	4904	Unicorn-38715.exe	101
PID 4904 wrote to memory of 2908	4904	Unicorn-38715.exe	101
PID 3328 wrote to memory of 1252	3328	b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe	100
PID 3328 wrote to memory of 1252	3328	b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe	100
PID 3328 wrote to memory of 1252	3328	b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe	100
PID 4020 wrote to memory of 636	4020	Unicorn-32772.exe	105
PID 4020 wrote to memory of 636	4020	Unicorn-32772.exe	105
PID 4020 wrote to memory of 636	4020	Unicorn-32772.exe	105
PID 740 wrote to memory of 716	740	Unicorn-8.exe	104
PID 740 wrote to memory of 716	740	Unicorn-8.exe	104
PID 740 wrote to memory of 716	740	Unicorn-8.exe	104
PID 1252 wrote to memory of 5044	1252	Unicorn-7911.exe	106
PID 1252 wrote to memory of 5044	1252	Unicorn-7911.exe	106
PID 1252 wrote to memory of 5044	1252	Unicorn-7911.exe	106
PID 3504 wrote to memory of 924	3504	Unicorn-8176.exe	107
PID 3504 wrote to memory of 924	3504	Unicorn-8176.exe	107
PID 3504 wrote to memory of 924	3504	Unicorn-8176.exe	107
PID 2896 wrote to memory of 4004	2896	Unicorn-60480.exe	109
PID 2896 wrote to memory of 4004	2896	Unicorn-60480.exe	109
PID 2896 wrote to memory of 4004	2896	Unicorn-60480.exe	109
PID 2440 wrote to memory of 976	2440	Unicorn-12260.exe	111
PID 2440 wrote to memory of 976	2440	Unicorn-12260.exe	111
PID 2440 wrote to memory of 976	2440	Unicorn-12260.exe	111
PID 4324 wrote to memory of 452	4324	Unicorn-12260.exe	108

C:\Users\Admin\AppData\Local\Temp\b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe
"C:\Users\Admin\AppData\Local\Temp\b00004d3126258378f321f39cfbbec58cf3c6ad14e7a9342b986b706a8ba6153N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41285.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41285.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2250.exe
        8⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59017.exe
        9⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30367.exe
        10⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8514.exe
        11⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42789.exe
        10⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54570.exe
        10⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        10⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52286.exe
        10⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
        9⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        10⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59955.exe
        9⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6007.exe
        9⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38509.exe
        9⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        9⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33530.exe
        8⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49012.exe
        8⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13014.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        7⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        8⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41357.exe
        10⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52117.exe
        10⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10963.exe
        9⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        9⤵
        
        PID:17384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1923.exe
        8⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6992.exe
        8⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20335.exe
        8⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
        8⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31480.exe
        7⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        8⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        8⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        8⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36656.exe
        7⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12718.exe
        7⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46194.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        7⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
        8⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
        9⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        9⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        8⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48052.exe
        8⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5042.exe
        8⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        8⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        8⤵
        
        PID:16368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        8⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34874.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exe
        7⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        8⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49090.exe
        8⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14916.exe
        8⤵
        
        PID:17196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7953.exe
        7⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17490.exe
        7⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
        7⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        6⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43532.exe
        7⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27990.exe
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
        6⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6336.exe
        6⤵
        
        PID:15456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55810.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30803.exe
        9⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        8⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        8⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        8⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27238.exe
        7⤵
        
        PID:15808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        7⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        8⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        8⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29410.exe
        8⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        7⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
        7⤵
        
        PID:16396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47398.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45219.exe
        7⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
        7⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        6⤵
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47843.exe
        6⤵
        
        PID:16300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
        6⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56421.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        6⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        7⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
        8⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33642.exe
        8⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        7⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36366.exe
        7⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49972.exe
        6⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1062.exe
        7⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1311.exe
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42649.exe
        7⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
        6⤵
        
        PID:17204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        6⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45156.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24783.exe
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18831.exe
        7⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        7⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
        6⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        7⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43532.exe
        6⤵
        
        PID:16788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23190.exe
        5⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        5⤵
        
        PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53103.exe
        5⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2145.exe
        5⤵
        
        PID:16364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53848.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
        7⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55810.exe
        8⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2790.exe
        9⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
        9⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        8⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        7⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48099.exe
        8⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61865.exe
        8⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        7⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12229.exe
        7⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43376.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        7⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9811.exe
        7⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32868.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
        6⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18705.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        5⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63101.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        7⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
        8⤵
        
        PID:13704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        7⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        7⤵
        
        PID:15784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        6⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        7⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe
        7⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe
        7⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15571.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
        6⤵
        
        PID:13504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43252.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40243.exe
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61720.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10802.exe
        6⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        8⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exe
        9⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        8⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49361.exe
        8⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61020.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        7⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        7⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11025.exe
        6⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
        7⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41383.exe
        7⤵
        
        PID:17276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42457.exe
        7⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21898.exe
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        6⤵
        
        PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
        5⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        6⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        7⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8732 -s 248
        8⤵
        Program crash
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
        7⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34890.exe
        7⤵
        
        PID:17168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        7⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        6⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30074.exe
        5⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
        6⤵
        
        PID:15064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        5⤵
        
        PID:11136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
        5⤵
        
        PID:15412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28130.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        6⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11958.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
      4⤵
      PID:6596
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 616
        5⤵
        Program crash
        
        PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
      4⤵
      PID:9756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57254.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60480.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60439.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29111.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7896.exe
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27907.exe
        8⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        9⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4846.exe
        9⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2483.exe
        9⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27797.exe
        8⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23621.exe
        9⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        9⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24698.exe
        8⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        8⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        8⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
        9⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        9⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        9⤵
        
        PID:17400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-770.exe
        8⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61560.exe
        8⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        8⤵
        
        PID:16960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53202.exe
        8⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17823.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
        7⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21902.exe
        7⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-283.exe
        6⤵
        Executes dropped EXE
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
        8⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        9⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62250.exe
        9⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        8⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe
        8⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        8⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        7⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29535.exe
        7⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29043.exe
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29944.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        8⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
        8⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        8⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40189.exe
        7⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42929.exe
        7⤵
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9811.exe
        7⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36985.exe
        6⤵
        
        PID:14204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49355.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29857.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43283.exe
        6⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25769.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        8⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        9⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1487.exe
        8⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24646.exe
        8⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14689.exe
        8⤵
        
        PID:17284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12405.exe
        8⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
        8⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
        8⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        7⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        6⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
        8⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
        8⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        7⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42755.exe
        7⤵
        
        PID:17192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24210.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        6⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6234.exe
        5⤵
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36345.exe
        8⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exe
        8⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe
        7⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33811.exe
        7⤵
        
        PID:15056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        6⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20118.exe
        6⤵
        
        PID:13548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1208.exe
        5⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
        5⤵
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8178.exe
        5⤵
        
        PID:15572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25603.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28893.exe
        6⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 632
        7⤵
        Program crash
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11762.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19130.exe
        7⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        7⤵
        
        PID:17192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17553.exe
        6⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        7⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12306.exe
        7⤵
        
        PID:17272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
        7⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22622.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exe
        6⤵
        
        PID:16776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16489.exe
        6⤵
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
        5⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
        7⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        7⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        8⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        7⤵
        
        PID:16880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23704.exe
        7⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        6⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30803.exe
        7⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45120.exe
        6⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exe
        6⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26018.exe
        5⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16797.exe
        6⤵
        
        PID:13512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        6⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        5⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
        5⤵
        
        PID:14976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51835.exe
        5⤵
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2224.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
        7⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44041.exe
        8⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        8⤵
        
        PID:17248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3946.exe
        8⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5622.exe
        7⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        7⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16697.exe
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40433.exe
        6⤵
        
        PID:12972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15457.exe
        6⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        5⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        6⤵
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        5⤵
        
        PID:11212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20205.exe
        5⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        5⤵
        
        PID:15488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33558.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9515.exe
        5⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62131.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exe
        6⤵
        
        PID:17220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42457.exe
        6⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64248.exe
        6⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
        5⤵
        
        PID:12772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
      4⤵
      PID:8640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
      4⤵
      PID:12724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10607.exe
      4⤵
      PID:16072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
      4⤵
      PID:17292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60439.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25219.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36677.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11870.exe
        8⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59676.exe
        8⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        8⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59894.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        8⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
        8⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49507.exe
        7⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe
        6⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        7⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
        7⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33364.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        7⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        7⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61037.exe
        7⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
        7⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe
        6⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
        7⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
        7⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48681.exe
        6⤵
        
        PID:16676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7232.exe
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56843.exe
        8⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        7⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23787.exe
        8⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        8⤵
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39665.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12254.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56178.exe
        6⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        6⤵
        
        PID:16960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4362.exe
        6⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
        7⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        7⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        6⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51607.exe
        7⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        7⤵
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45285.exe
        6⤵
        
        PID:13896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
        6⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54414.exe
        5⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        6⤵
        
        PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
        5⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        5⤵
        
        PID:15876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
        7⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10963.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18391.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24210.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        6⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
        6⤵
        
        PID:15600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8041.exe
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        6⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        7⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58985.exe
        7⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32249.exe
        6⤵
        
        PID:13948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        6⤵
        
        PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17823.exe
        5⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30803.exe
        6⤵
        
        PID:14224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19919.exe
        5⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
        5⤵
        
        PID:17312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29469.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64793.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39853.exe
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
        7⤵
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17055.exe
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        6⤵
        
        PID:15000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
        5⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3610.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60304.exe
        6⤵
        
        PID:16664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
        5⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        5⤵
        
        PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64014.exe
      4⤵
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        5⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34591.exe
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40948.exe
        6⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39657.exe
        6⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50688.exe
        5⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
      4⤵
      PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62250.exe
        5⤵
        
        PID:16420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        5⤵
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
      4⤵
      PID:12056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe
      4⤵
      PID:16884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        5⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30367.exe
        7⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34591.exe
        8⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54129.exe
        9⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        9⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
        8⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28129.exe
        7⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24646.exe
        7⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        6⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exe
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        6⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
        6⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44029.exe
        5⤵
        
        PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49012.exe
        5⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61907.exe
        5⤵
        
        PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
      4⤵
      PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51233.exe
        5⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28037.exe
        6⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53641.exe
        7⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        8⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12882.exe
        8⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
        8⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20833.exe
        7⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10082.exe
        7⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
        7⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        6⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        5⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2405.exe
        5⤵
        
        PID:14908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58123.exe
      4⤵
      PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43532.exe
        5⤵
        
        PID:16804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        5⤵
        
        PID:16256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
      4⤵
      PID:9744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16802.exe
      4⤵
      PID:15048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37284.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59427.exe
      4⤵
      PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35089.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        6⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41279.exe
        6⤵
        
        PID:13392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        6⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        5⤵
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        5⤵
        
        PID:12316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
      4⤵
      PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54684.exe
      4⤵
      PID:11856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1357.exe
      4⤵
      PID:15484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
      4⤵
      PID:16260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
    3⤵
    PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
      4⤵
      PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        5⤵
        
        PID:9984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        5⤵
        
        PID:15260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7350.exe
      4⤵
      PID:14964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32788.exe
      4⤵
      PID:1204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9330.exe
    3⤵
    PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
      4⤵
      PID:9712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
      4⤵
      PID:16136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
      4⤵
      PID:1412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35770.exe
    3⤵
    PID:10852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
    3⤵
    PID:14572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38715.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38715.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11762.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        8⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exe
        9⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15379.exe
        9⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
        9⤵
        
        PID:17168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55373.exe
        8⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        8⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19629.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24698.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        7⤵
        
        PID:16940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48815.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        7⤵
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36070.exe
        6⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exe
        6⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        7⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        8⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15863.exe
        9⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
        9⤵
        
        PID:16692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23380.exe
        9⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe
        9⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        8⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        8⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        8⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
        7⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6874.exe
        8⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
        8⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45120.exe
        7⤵
        
        PID:14044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        6⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        7⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
        7⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exe
        6⤵
        
        PID:16796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
        6⤵
        
        PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42224.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        7⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        6⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1146.exe
        6⤵
        
        PID:17212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
        5⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        6⤵
        
        PID:15940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        5⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23492.exe
        5⤵
        
        PID:17292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25480.exe
        5⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
        5⤵
        
        PID:17208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15004.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13132.exe
        6⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        7⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27103.exe
        8⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56053.exe
        8⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        7⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6364.exe
        7⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        7⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        6⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        7⤵
        
        PID:15872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        6⤵
        
        PID:17344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15052.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64357.exe
        7⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
        7⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47336.exe
        7⤵
        
        PID:17232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17055.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        6⤵
        
        PID:15244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8092.exe
        5⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
        6⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
        5⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        5⤵
        
        PID:15984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
        6⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47397.exe
        7⤵
        
        PID:16736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34159.exe
        6⤵
        
        PID:10952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44055.exe
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14882.exe
        5⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        5⤵
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28316.exe
        5⤵
        
        PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
      4⤵
      PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        5⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        6⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61865.exe
        6⤵
        
        PID:17332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        5⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12630.exe
        5⤵
        
        PID:17280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27289.exe
        5⤵
        
        PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22197.exe
      4⤵
      PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
      4⤵
      PID:12168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43378.exe
      4⤵
      PID:15420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8175.exe
      4⤵
      PID:3488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-755.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24067.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29983.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
        7⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32788.exe
        7⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33583.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        6⤵
        
        PID:14512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8633.exe
        6⤵
        
        PID:11428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
        6⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13957.exe
        5⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29410.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        6⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
        5⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63171.exe
        5⤵
        
        PID:17168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        5⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59318.exe
        6⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        7⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
        7⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        7⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58201.exe
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20205.exe
        6⤵
        
        PID:15552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16496.exe
        6⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46787.exe
        6⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        5⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53335.exe
        6⤵
        
        PID:15776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
        6⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        5⤵
        
        PID:10996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-396.exe
      4⤵
      PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24783.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4684.exe
        6⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        7⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        7⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10082.exe
        7⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
        7⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61534.exe
        6⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20754.exe
        6⤵
        
        PID:16704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        6⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51508.exe
        5⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49204.exe
        5⤵
        
        PID:13484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35956.exe
        5⤵
        
        PID:11396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55192.exe
        5⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
        5⤵
        
        PID:13272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5213.exe
      4⤵
      PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        5⤵
        
        PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
      4⤵
      PID:9704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
      4⤵
      PID:15656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48663.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46215.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        5⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41503.exe
        6⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
        8⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33110.exe
        8⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        8⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        7⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        7⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
        7⤵
        
        PID:16276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12613.exe
        6⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40433.exe
        6⤵
        
        PID:13432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        5⤵
        
        PID:692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        5⤵
        
        PID:16404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11357.exe
      4⤵
      PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55810.exe
        5⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
        6⤵
        
        PID:12956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        6⤵
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        5⤵
        
        PID:9632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13040.exe
        5⤵
        
        PID:15484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
      4⤵
      PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64025.exe
        5⤵
        
        PID:14616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62787.exe
      4⤵
      PID:15420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35644.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
      4⤵
      PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16615.exe
        5⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        6⤵
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40154.exe
        6⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        5⤵
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9706.exe
        5⤵
        
        PID:12932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51150.exe
      4⤵
      PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        5⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        5⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33330.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1870.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
      4⤵
      PID:11544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
      4⤵
      PID:5988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
    3⤵
    PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-678.exe
        5⤵
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        5⤵
        
        PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
      4⤵
      PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28316.exe
      4⤵
      PID:800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
    3⤵
    PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
      4⤵
      PID:10084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34918.exe
      4⤵
      PID:16296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
      4⤵
      PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
    3⤵
    PID:11192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56076.exe
    3⤵
    PID:15540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47573.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47573.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11814.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
        6⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-278.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        8⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 176
        9⤵
        Program crash
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        8⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        8⤵
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        8⤵
        
        PID:168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        7⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19602.exe
        7⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        7⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
        6⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        7⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48487.exe
        7⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59972.exe
        7⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
        6⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9126.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63646.exe
        7⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        6⤵
        
        PID:15236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64885.exe
        5⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12882.exe
        6⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43994.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
        6⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        5⤵
        
        PID:16108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12940.exe
        5⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        6⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        7⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        7⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24865.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
        7⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45120.exe
        6⤵
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        6⤵
        
        PID:15012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
        6⤵
        
        PID:12360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59484.exe
        6⤵
        
        PID:16228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43043.exe
        5⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        6⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
        6⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        6⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56194.exe
        5⤵
        
        PID:15164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
        5⤵
        
        PID:15840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21275.exe
        5⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9126.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50071.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        7⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41279.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32946.exe
        6⤵
        
        PID:15872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        5⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        5⤵
        
        PID:15180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        5⤵
        
        PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
      4⤵
      PID:7552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
      4⤵
      PID:15812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56329.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        5⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        6⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        7⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48099.exe
        8⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28040.exe
        8⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        7⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11958.exe
        6⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26117.exe
        7⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        7⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        6⤵
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        5⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        6⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
        6⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51420.exe
        6⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30790.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56194.exe
        5⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57932.exe
        5⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56113.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        5⤵
        
        PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
      4⤵
      PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23953.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        7⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        7⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39167.exe
        7⤵
        
        PID:16104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        7⤵
        
        PID:17328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        6⤵
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26367.exe
        6⤵
        
        PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        5⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46589.exe
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60304.exe
        6⤵
        
        PID:16656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33642.exe
        6⤵
        
        PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        5⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11207.exe
        5⤵
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53279.exe
        5⤵
        
        PID:17376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
        5⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
        5⤵
        
        PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
      4⤵
      PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47907.exe
        5⤵
        
        PID:14584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52566.exe
      4⤵
      PID:15376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
      4⤵
      PID:4204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
      4⤵
      PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
        5⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        6⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26117.exe
        7⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        7⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59484.exe
        6⤵
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
        6⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
        5⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        5⤵
        
        PID:16752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35956.exe
        5⤵
        
        PID:17376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
      4⤵
      PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16797.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
        5⤵
        
        PID:15884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        5⤵
        
        PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
      4⤵
      PID:11100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
      4⤵
      PID:16256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50682.exe
      4⤵
      PID:12500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41072.exe
    3⤵
    PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
      4⤵
      PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
        5⤵
        
        PID:16088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
      4⤵
      PID:9796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39491.exe
      4⤵
      PID:16316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exe
      4⤵
      PID:17388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
    3⤵
    PID:7656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
    3⤵
    PID:10596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51345.exe
    3⤵
    PID:3116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3646.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        5⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
        6⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe
        8⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28258.exe
        8⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        7⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60381.exe
        7⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
        7⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        6⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        7⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44501.exe
        6⤵
        
        PID:16636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4008.exe
        5⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43889.exe
        6⤵
        
        PID:16968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55583.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        5⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7648.exe
        5⤵
        
        PID:15636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
      4⤵
      PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27731.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
        6⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33642.exe
        6⤵
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34159.exe
        5⤵
        
        PID:10960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
        5⤵
        
        PID:16164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
      4⤵
      PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
        5⤵
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        5⤵
        
        PID:14096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15292.exe
      4⤵
      PID:11312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
      4⤵
      PID:16724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40379.exe
      4⤵
      PID:17284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
      4⤵
      PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42109.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
      4⤵
      PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26091.exe
        6⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47497.exe
        7⤵
        
        PID:16244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38051.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51289.exe
        6⤵
        
        PID:15648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        6⤵
        
        PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41419.exe
        5⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34093.exe
        6⤵
        
        PID:14664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        6⤵
        
        PID:17308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
        5⤵
        
        PID:16952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        5⤵
        
        PID:15512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
      4⤵
      PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13210.exe
        5⤵
        
        PID:9184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53812.exe
        5⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        5⤵
        
        PID:15188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4148.exe
      4⤵
      PID:9612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56194.exe
      4⤵
      PID:15132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4672.exe
    3⤵
    PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
      4⤵
      PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        5⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10963.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30310.exe
        5⤵
        
        PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
      4⤵
      PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33133.exe
        5⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16853.exe
        5⤵
        
        PID:16320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9706.exe
      4⤵
      PID:13044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
      4⤵
      PID:5992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
    3⤵
    PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
      4⤵
      PID:8564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10963.exe
      4⤵
      PID:11284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57145.exe
      4⤵
      PID:17396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32781.exe
      4⤵
      PID:3672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21410.exe
    3⤵
    PID:8448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
    3⤵
    PID:13004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
      4⤵
      PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44627.exe
        5⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30367.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        7⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        7⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
        7⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 72
        8⤵
        Program crash
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        6⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12246.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        6⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        5⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34591.exe
        6⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41865.exe
        5⤵
        
        PID:11080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61238.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50034.exe
      4⤵
      PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52105.exe
        5⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
        6⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        5⤵
        
        PID:13552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-273.exe
        5⤵
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        5⤵
        
        PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43043.exe
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56194.exe
      4⤵
      PID:15144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
      4⤵
      PID:632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41311.exe
      4⤵
      PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9920.exe
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        5⤵
        
        PID:12912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        5⤵
        
        PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
      4⤵
      PID:9520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45285.exe
      4⤵
      PID:13904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40617.exe
      4⤵
      PID:15756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
      4⤵
      PID:4216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50495.exe
    3⤵
    PID:7376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39827.exe
      4⤵
      PID:11052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41637.exe
      4⤵
      PID:15424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
      4⤵
      PID:4852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
    3⤵
    PID:10164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
    3⤵
    PID:15408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
    3⤵
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-678.exe
        5⤵
        
        PID:12068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
      4⤵
      PID:12800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41533.exe
    3⤵
    PID:8428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
      4⤵
      PID:15548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37387.exe
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
      4⤵
      PID:216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41062.exe
    3⤵
    PID:12144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
    3⤵
    PID:16368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57932.exe
    3⤵
    PID:17296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
  2⤵
  PID:5284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
    3⤵
    PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31327.exe
      4⤵
      PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        5⤵
        
        PID:15600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        5⤵
        
        PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1538.exe
      4⤵
      PID:12576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
      4⤵
      PID:17208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
      4⤵
      PID:3888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47424.exe
    3⤵
    PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4570.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
      4⤵
      PID:17340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49204.exe
    3⤵
    PID:13144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
    3⤵
    PID:17372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
  2⤵
  PID:6648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
    3⤵
    PID:10936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58166.exe
    3⤵
    PID:15772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
    3⤵
    PID:652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31359.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31359.exe
  2⤵
  PID:10892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65440.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65440.exe
  2⤵
  PID:436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
  2⤵
  PID:16008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52620.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52620.exe
  2⤵
  PID:5496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2172 -ip 2172
1⤵
PID:6088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6596 -ip 6596
1⤵
PID:9236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4196 -ip 4196
1⤵
PID:9596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 8732 -ip 8732
1⤵
PID:9676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 16676 -ip 16676
1⤵
PID:17400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2856 -ip 2856
1⤵
PID:12500

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe

Filesize
468KB

MD5
be4dd9c65f789b5aa62edc88f4975228

SHA1
dff72c18bb51e1965bfe1ec083c7d91d48e55ee6

SHA256
c0b899292908b347d4bcfba37e14e07ced0c0ff3a182ac3bde407f0d496cc2ab

SHA512
9012d9df6438885561e42ea62d57bbe7bb6eb25907df0a69f1ea6cbbba5edb2d28b30903576a9b84541eb9b02bd6fc7f7b0b374dfc594757e6cc4a898296d7a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11814.exe

Filesize
468KB

MD5
9b5c61ffb9678236d38e3c25101ec2f1

SHA1
cbdbecee5443405a75d47087c85e3954ea266dd5

SHA256
175f1e9cd2c30fbe5bb0b8935b2d6094a7efa978a239bbd70cfa8d52c7e7cbfc

SHA512
4e842f9e743334a40d917e8adfecedabb3d2da410a92c1b4538eb7ed51e2ff9c05c3c1f62fa0db8553443ba1576f295889c667a1d9ff91698220c0c3b65b086d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11958.exe

Filesize
468KB

MD5
703a4da4d31362e41fad6e57232eeddf

SHA1
eb106d0f12d808b6af6495ab6b9e7f8f2fe4300d

SHA256
7b6740ff99784ad0c999fd41af828e3c559a3d8a009171db728c16b0fbc4e9fc

SHA512
8a46f6c073b0eaa6a836534654d4988ec90a3cca5f72ac2e60b320fb9c85e1ac31f4dbc1c2f32d549f131b5cba4fe171451b350f58eedcdcf963ecf4946e1555

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe

Filesize
468KB

MD5
2acd89d7f86b002dbc5a6680aaba8bbb

SHA1
9fc98168b31e4b0ee80c77b24dec577207694ce2

SHA256
a20569c532c5c798514821a11084d53d0fd05791b24f7ea1f8d29b81bc38cfaf

SHA512
3424190ba0294ded06a55e5247126eeab4aab2e1b0d7c6e0d8c64b35c2b4c6aa6b51166f61d34b037fd33586b3a3327754b930d41b098c7499bc193843653cc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe

Filesize
468KB

MD5
59f080b22a5fea85c3293d66c6dd21c6

SHA1
1bc5fadb2c2643830aee428efd469a837785249d

SHA256
ff41774f6db74b1dc9136bf0837e864fa2fc98b8d7c52a91cffc77e743fd3f19

SHA512
eb8db32c2e325ad383b5160ce9c09b39e8a4fd34d35eb2f3588a8a585ced209a47aea1c211e6b526d0819596c7b3f9aad8d8c49c171a7db5268e04e39f6041cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15004.exe

Filesize
468KB

MD5
6f4ff8fe5e39f5cd6643fc23100c7620

SHA1
c405c98b223b2fe4c8009216854b32ca2acd188d

SHA256
556e88f35e9898e45170106a055ad07c8eafa2f6212a1043f2aa3c855a2019d3

SHA512
8c83c649897b16084966ba30998f653e625081df78d0a1112023540c5f64db37f3192b727247cd8c6b8fc5358d7db67ef78a9d1b2ead7ed051e2b9f175ec9ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe

Filesize
468KB

MD5
1202258acb5c6f964bf715bcae9f10d8

SHA1
1263c1b32c656cff185b419ea5f170be0c6d362d

SHA256
2e3dcee0777fc49fb4460d31b3419a56424076720672dd73ed1adf052a511490

SHA512
29a22ce46a173653d6f966c9fa63317ba72d4c39f8e84253cc5665f0e366acae7b9c107a45fc53b1a3424b4474efdd48250cdd045afe3e6a39bb59b4a2dd63c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe

Filesize
468KB

MD5
d6c363178a240cd28b930b86d97c2eb6

SHA1
88174cf69ea7d156c51a698d07319d926348db58

SHA256
39a693f364e8271efdcb385daf520c9cace0cb1a1f338754b3bac346d3683e97

SHA512
0fb4840f042a1aebe29dbe8b546ba08ca25534e8ff752b02f45737b9f2ce731b2061d1605f63d3397b11330775430bea450dc00ad6abacd1479c8a31c3a268b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe

Filesize
468KB

MD5
e7093275deb0b4ebc92524d99a085d1b

SHA1
3b7a68415fd47df610b340ac11ad063b0a4e4565

SHA256
8084f0deb2357de011d4ab06ce5690631469cb3fcb738c5318d85a6c84ae763a

SHA512
6d75a0dd846a8a899bd30f097eb00c32a8d623de6b58ab65fa697ef571006b8ed922b6f7e7e53b8632e5119baf620f317eeb4fbc11ec70dd5444a76e1bc8548d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24067.exe

Filesize
468KB

MD5
b5c1f1e8a68962c3ad94bb3f8f0d2542

SHA1
7a54a976e9d431bb81f514b5e5ee0181ad063b2c

SHA256
42bffd13a1b276036362cbb24320d81626e6db01b1568d6322c1a020a54a9613

SHA512
2c2ab5ae438006a29b5307f2bc67ccea64d5ccd0fff8ae5816b9010c5ac35243d6e10a3b170f76f678d64dd2db2b5fc3611d837fbcb04faf07eb7824ef679f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25219.exe

Filesize
468KB

MD5
afb1082e3eb11b2f4bff85e0215f3f66

SHA1
66ac6e3d69ec31e9e7433eeb0b42e8bf4dc09183

SHA256
a0d6d2bcc910cfbc5eb0850278fc245b696b9468b973fbae7a17186820a66a05

SHA512
e2ab7a7ac40b2932a8f16a460d240c4da085591f2371a3aeb91a68acccda21cd8f3d8bbf68341cae1e1d29d00a270e7f0f29eb7d6d1fd1f930561341e03a99f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe

Filesize
468KB

MD5
6fc6efb9beb7e36af7154733ffc791f5

SHA1
78a603cdb74e9ea551f9fa02576fe19c0086c36c

SHA256
501ea92541fd1afac8a7693e1ae98b84e1bfc7f78e0b38790eb37aa2c31c37be

SHA512
9d03cfe2d2ee114ab424376ee7be972bc0310f9635484f47baf60483532e5c0e390b138835d6f23fdde085f455ec32fa488f1018d224c2b7c861b4e26576cc87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe

Filesize
468KB

MD5
f740ef680606ed6fe4933bfb7932671d

SHA1
369a9a7c87e61027f72fe72fcf83d235a492988b

SHA256
321a3833a2d2de06c3b18a60091e903c29f19396aed5fbb803736f348f69ea2c

SHA512
bc7e2851f8b51836ad5256570d1bb44f92c448082bc72959e028bc053b5c7270d6b527e9b1226ed0e2b392de97395af4d9719ab8354f0bb9aa2114ab60852e6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe

Filesize
468KB

MD5
edd97db4dce4d57d143cc70014f1d009

SHA1
f05b4620eb702bd5be3e348cca7ebd6911045006

SHA256
b483058b4c05efcddfd4735b99b0c7067ec948cb899ea3e8206321f1c29367b2

SHA512
10c5677d9f80a65195f0a62f9aa9f83045e65fc94a0a15ec848a3ad4f80d4ff3bee401ca61eb91ce4138e57948aa76865eed98729c1659b02e1d82c7a6c4767d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3646.exe

Filesize
468KB

MD5
a16618150d02f07e19670309565ef8e2

SHA1
5a2c2563e76d66bed7622b90ec7c9419b8354955

SHA256
8464b30185183ef84d99d88350c5f7716db1d70318b57fee5f8184ef255adf9f

SHA512
4358b9a0053a43e88db26cea75d9dd84b756b1ca8ed7e7530510817c18142765a5d36cfac350aea36506f307f89cbac9f4af8831a102c77312d57adce7ebfc08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37465.exe

Filesize
468KB

MD5
01cde1d8eee742f6f60970c138491820

SHA1
05b850cf73349c7deb43b273ebc3c2e351d55135

SHA256
859ef173d83bb2d71df5321cfefce1fde23fac3287f777d1e47bd8e67951ccda

SHA512
0b357b7f31ec98a005d6f6e131fd9cf9af4c241e4ce678185e9998fa3113c7ca0bf163bd5f723566331073f26cecb62cc495491c38ccd191a784ae02007a43f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38715.exe

Filesize
468KB

MD5
d38675acdfa07ec840c12afb7a34e5e3

SHA1
6af1d2817a40ad8fcca503f884c17bc6bf202bf3

SHA256
c8254b60295f2ef76bddd8d097dd4af6fd88e236cc7ebd155e474fc35b8b8a34

SHA512
a7a6b3b6ae052d6f5ad961a3908ce0e9b4517205109cb9599caf4364ad5e8cd1eb05879f1bb6d490a551a6d67b22a42610622d401bdff3718590325ae4c550bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41285.exe

Filesize
468KB

MD5
9dff020c047c5662bcc1b725bdd16aa0

SHA1
46f93987dc136040a8555359a15db8f2dc82b13d

SHA256
63b2bedc0455bb3d94a0183c908d28b15c1864021d924b12dfe45e763a053c0d

SHA512
cb763a3aff3acd685e0daa1e2785e675c5a1abb612e5bac8611ac41e30eaa93568fcd18623ed1850bdc73f89508b5535e465eb8973fcb9704f55391449a54fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47573.exe

Filesize
468KB

MD5
048fb307a01680520e52e377657da74e

SHA1
51f0aaa19fe9234685b13644b6dfef9060ee3631

SHA256
26443cb8b8eacce6442a39f73e3e9bfe227dfc448fafd8f797ef1b6938bed6db

SHA512
9847c0073a6a791611a2ce5bca8abb66407b2cd4438ea9425cbe3bcfcede37b98d4abf9bed5f70bc6d1483228b91c449949dcc403524f96bf63d0459ee1e0859

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48663.exe

Filesize
468KB

MD5
c9332afbea750f3b48e9ef15778dd1df

SHA1
425c3dd4f02e8fe065cb4ea85fca35e2c23f97fd

SHA256
a7ef615c413210543c461a645991b4453f65f6873d4820d1a5fd0e45752c2cf5

SHA512
1d6ae7d0a4e8427d8e0913ad77125352770aa8fb37e79d4c46b23cb557804fda59c2688d5594eb0e6b548ae02f1091c5f5c5bed0e8026493ffe8394db9ab853b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe

Filesize
468KB

MD5
20c8c8c64427bb887a3e9a02a1c3aa59

SHA1
089f52a24ef382d2abc6fcae0d4ed4cb8b8b0be7

SHA256
b8349c09bea963dc41b09d92b8e3c3c0a6edb4854ee2f99af0fa59d3868d8212

SHA512
05a5e51782f7e2e28b10aacda35fb3ea7f2627efa995d3dc58ffc37d355c4f3d2e75e206d9abd299a293beeb3465d2b27edc3e112f968b569005845ec9a08fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe

Filesize
468KB

MD5
4e62c408f19fa86b74e530d409339a5b

SHA1
0d4bd91ec6e0f747465230ccbb01bb0a06eb6bae

SHA256
d0478860db320a60249ccb48486bedad6623c9eb3819e673ac7272c2a845e591

SHA512
634cbed8fc2ed3c6e2b1f47d84b002ba9ae368bfb2dd44a4b675ca211b038bbe954af030b574c8198ea670e2cf3f4fb9f74a78ca7dac637a623f9830fdafa54d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe

Filesize
468KB

MD5
b5fc42a72df27bd5c9297e0209433e8e

SHA1
851e06ecce7c80cc56aff2586e7faa0982428af7

SHA256
8ac7be2f9cd45a23c82cc4902aacd736c74c1de382d13d7689e02062b6c64faf

SHA512
fb723befb916a665135ead7c4ab39757823f88ad244e8abe2e4ffd34f2138de74b73c3cceaec6c0d5f1e08ff23b1be9e3b9ebdb8c671937f245e92066cca93b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53848.exe

Filesize
468KB

MD5
967a96c20863e9c49b107e58f971ec46

SHA1
8eb33c53382ca49fe6c7865615c0fe015fea3a88

SHA256
da61d40b5434aeee41ee56093f660e18b17970de14e3ad1b8be27f364c850d3d

SHA512
aa2a3f8ec0a6e83290c3986c5a488908316098854d90fccf4b0c69d442f4d3d0e28a69208613d8902cdd84df7c86f459602a4f8c2f5993e29d931cd68625e760

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe

Filesize
468KB

MD5
d6e9622340faa3dafc32f8a768dd6464

SHA1
0f7456ea348d1aa9eaabd03c9d3f75294d44f9fb

SHA256
b843f58d0be755dbdc22c6007b0d3f33e10b9191153ef4ed190293b7f66a159e

SHA512
842676ef6a986d74c4e581ce40d966c5cfd6ad65b1abb2f1b9cb6848ecfd28ba3dda08821bfbfe276f4e2039ef349b285b64538ca26157391d6390f2d6a9a8a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60439.exe

Filesize
468KB

MD5
d00b1ab13d91003853d884ad35473b72

SHA1
4a6ed25f39ef5e5d997f0e67a8fdf4e07b558e90

SHA256
cc5cf4faeaa33ae76c4faa6cdf6a2adc32dccc137c6de4b3f5693d98598c7fb0

SHA512
44eaae554ce7208c620cf41c0579df39495ed901bcec71fdfbdfbc9f82e0dbdbcff5eaec14c320b97148b005ed557e1be1b1d778d35d590a66dea1bfb157cd57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60480.exe

Filesize
468KB

MD5
38a02f8ffc510d637aa2f6cfffe8b4a2

SHA1
731f2ab77d272bfc47ec087e1a185756dfb97af4

SHA256
53d8eb6f8ce0e051c2c5b626c60282fa8bf46b82aee879d9f0f0471b682f69bb

SHA512
bdc3b8194574838d912e0c2856b5bfc8bcbfdd2298a7eae669df7d74c9a09defd367616672af549bf3a4035aefcb47170775fd435fd6187f99a84cff6e3d807a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-755.exe

Filesize
468KB

MD5
0e32cc337804c484ac7c8e30c76bf588

SHA1
d4c8ecadb34356645cb02856a7e8e547d7fcdd57

SHA256
a56b199921c453a99e1dbf93462fc67f5ba9a21a4d967e131387aa54cc190270

SHA512
68cff80ceae749648c9946f40333f8fb60f840f73c475746204bbbcfd4cb10d96cb785e5330c9b123776cd5624af71307b161918979b36a77abb95f4860d50bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe

Filesize
468KB

MD5
c9af4912568b50cb7fca349cc8764d5d

SHA1
7c4bf48f722171005ece84281bd4a2cbfbb00000

SHA256
12beb0edbbfc8072feebb999cab4bfe9975ae29a1bc24cda71f13096d69ac08a

SHA512
dbe8356296093729df752549e033ee39a010dc05f02ab9a0a226c1d76b34765d7eaa2588d2a0df69104035287ae0addb6b1200bcd1d2740d30625e3f0f496883

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8.exe

Filesize
468KB

MD5
c7e035b984561a386a6e3630385e68e8

SHA1
dc1441d66270b201453ab0221d93eda57ed72f3a

SHA256
9b0af1efdd89a436ed3a176e583990df7e6eba99dd48f67bccee7cbd678f5dfa

SHA512
118699ecf80a8934c88753d52533cfe0387af21be06741a1327fe77286eaa2ecf1f5f240f4ca73aed706aaa844cee4292c2a07f89835c52beecc1d2e4455d87b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe

Filesize
468KB

MD5
ca4fec97044e9c18eb89a678b28af7fc

SHA1
8ad526e2bcd388b3f20864e25f0832f37185df96

SHA256
302f37d4748a08d9fb2062dfbf5dd603d0e0146ee5cc257065b488bfc7b38904

SHA512
a1a2edaf7517eeb075d5f775b3c050642ddd212d46ef00c338323e377967982c6e169eda83b30c6cf6668875aabbeec22bda585a196511ef19b70edda6f8e21c

Download Submit
memory/636-2668-0x0000000075EF0000-0x0000000075F53000-memory.dmp

Filesize
396KB

Download
memory/2268-3147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15224-3018-0x00007FF8A1DB0000-0x00007FF8A1FA5000-memory.dmp

Filesize
2.0MB

Download
memory/16136-3134-0x00007FF8A1DB0000-0x00007FF8A1FA5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads