59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151

Analysis

max time kernel
113s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe
Size

468KB
MD5

f587b24b6023359bc8976b6316b034b0
SHA1

a3373045ef3e429407bf82d483e779d464a75bd8
SHA256

59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151
SHA512

338e303fc23651983213a8fb8b91481c660da10bd881670d5d4f827b4dd857af055ff49cc41feb6251af5e2cd36e64366e4ac8db825ffa91ab1bdd39908e254c
SSDEEP

3072:KbZUog/dI+5UtbYiPYtscf8VEChFiIpAOmHA7VsQBaN8bqQu4Plp:Kb6ovqUtFP0scfH0tbBaieQu4

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3692	Unicorn-42569.exe
4824	Unicorn-33929.exe
5032	Unicorn-22231.exe
4560	Unicorn-14224.exe
1952	Unicorn-10695.exe
3536	Unicorn-24430.exe
2092	Unicorn-60384.exe
3520	Unicorn-872.exe
2756	Unicorn-13679.exe
3552	Unicorn-58049.exe
3992	Unicorn-680.exe
3972	Unicorn-35391.exe
5020	Unicorn-41256.exe
1500	Unicorn-9144.exe
2680	Unicorn-11182.exe
1088	Unicorn-16353.exe
4404	Unicorn-54432.exe
3780	Unicorn-43545.exe
920	Unicorn-48184.exe
4896	Unicorn-10680.exe
2020	Unicorn-56160.exe
2024	Unicorn-1558.exe
3528	Unicorn-18391.exe
4724	Unicorn-10488.exe
1412	Unicorn-10488.exe
3116	Unicorn-4358.exe
3244	Unicorn-26353.exe
4924	Unicorn-42689.exe
3720	Unicorn-30991.exe
3568	Unicorn-58760.exe
3672	Unicorn-17417.exe
4612	Unicorn-5719.exe
4828	Unicorn-35865.exe
4984	Unicorn-37903.exe
4764	Unicorn-10208.exe
4160	Unicorn-7255.exe
3744	Unicorn-51625.exe
3468	Unicorn-17535.exe
1924	Unicorn-53737.exe
1404	Unicorn-22910.exe
4992	Unicorn-12512.exe
1172	Unicorn-20681.exe
1440	Unicorn-54121.exe
1176	Unicorn-4655.exe
4420	Unicorn-4920.exe
4108	Unicorn-13088.exe
4532	Unicorn-20494.exe
1792	Unicorn-50592.exe
2384	Unicorn-39631.exe
456	Unicorn-25895.exe
5068	Unicorn-20295.exe
1020	Unicorn-50769.exe
4492	Unicorn-55408.exe
3248	Unicorn-58745.exe
2360	Unicorn-44521.exe
1904	Unicorn-46559.exe
2588	Unicorn-19825.exe
2808	Unicorn-43567.exe
1044	Unicorn-8703.exe
1560	Unicorn-52881.exe
4880	Unicorn-57520.exe
1204	Unicorn-43753.exe
5072	Unicorn-43753.exe
3084	Unicorn-60089.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2612	3972	WerFault.exe	97
3796	3972	WerFault.exe	97
5608	4004	WerFault.exe	158
6348	6500	WerFault.exe	264
9048	5780	WerFault.exe	230

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52616.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5428	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	7992	dwm.exe
Token: SeChangeNotifyPrivilege	7992	dwm.exe
Token: 33	7992	dwm.exe
Token: SeIncBasePriorityPrivilege	7992	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe
3692	Unicorn-42569.exe
5032	Unicorn-22231.exe
4824	Unicorn-33929.exe
4560	Unicorn-14224.exe
1952	Unicorn-10695.exe
3536	Unicorn-24430.exe
2092	Unicorn-60384.exe
3520	Unicorn-872.exe
2756	Unicorn-13679.exe
3552	Unicorn-58049.exe
3992	Unicorn-680.exe
5020	Unicorn-41256.exe
3972	Unicorn-35391.exe
1500	Unicorn-9144.exe
2680	Unicorn-11182.exe
1088	Unicorn-16353.exe
4404	Unicorn-54432.exe
3780	Unicorn-43545.exe
920	Unicorn-48184.exe
4896	Unicorn-10680.exe
2020	Unicorn-56160.exe
3528	Unicorn-18391.exe
3116	Unicorn-4358.exe
2024	Unicorn-1558.exe
4724	Unicorn-10488.exe
1412	Unicorn-10488.exe
3244	Unicorn-26353.exe
4924	Unicorn-42689.exe
3720	Unicorn-30991.exe
3568	Unicorn-58760.exe
4612	Unicorn-5719.exe
3672	Unicorn-17417.exe
4828	Unicorn-35865.exe
4984	Unicorn-37903.exe
4764	Unicorn-10208.exe
4160	Unicorn-7255.exe
3744	Unicorn-51625.exe
3468	Unicorn-17535.exe
1924	Unicorn-53737.exe
1404	Unicorn-22910.exe
1172	Unicorn-20681.exe
4992	Unicorn-12512.exe
456	Unicorn-25895.exe
1176	Unicorn-4655.exe
4420	Unicorn-4920.exe
1440	Unicorn-54121.exe
4108	Unicorn-13088.exe
2384	Unicorn-39631.exe
1792	Unicorn-50592.exe
5068	Unicorn-20295.exe
4532	Unicorn-20494.exe
1020	Unicorn-50769.exe
4492	Unicorn-55408.exe
3248	Unicorn-58745.exe
1904	Unicorn-46559.exe
2588	Unicorn-19825.exe
2360	Unicorn-44521.exe
2808	Unicorn-43567.exe
1044	Unicorn-8703.exe
1560	Unicorn-52881.exe
4880	Unicorn-57520.exe
3084	Unicorn-60089.exe
1204	Unicorn-43753.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3692	3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe	82
PID 3728 wrote to memory of 3692	3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe	82
PID 3728 wrote to memory of 3692	3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe	82
PID 3692 wrote to memory of 4824	3692	Unicorn-42569.exe	83
PID 3692 wrote to memory of 4824	3692	Unicorn-42569.exe	83
PID 3692 wrote to memory of 4824	3692	Unicorn-42569.exe	83
PID 3728 wrote to memory of 5032	3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe	84
PID 3728 wrote to memory of 5032	3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe	84
PID 3728 wrote to memory of 5032	3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe	84
PID 4824 wrote to memory of 4560	4824	Unicorn-33929.exe	87
PID 4824 wrote to memory of 4560	4824	Unicorn-33929.exe	87
PID 4824 wrote to memory of 4560	4824	Unicorn-33929.exe	87
PID 3692 wrote to memory of 1952	3692	Unicorn-42569.exe	88
PID 3692 wrote to memory of 1952	3692	Unicorn-42569.exe	88
PID 3692 wrote to memory of 1952	3692	Unicorn-42569.exe	88
PID 3728 wrote to memory of 3536	3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe	89
PID 3728 wrote to memory of 3536	3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe	89
PID 3728 wrote to memory of 3536	3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe	89
PID 5032 wrote to memory of 2092	5032	Unicorn-22231.exe	92
PID 5032 wrote to memory of 2092	5032	Unicorn-22231.exe	92
PID 5032 wrote to memory of 2092	5032	Unicorn-22231.exe	92
PID 4560 wrote to memory of 3520	4560	Unicorn-14224.exe	93
PID 4560 wrote to memory of 3520	4560	Unicorn-14224.exe	93
PID 4560 wrote to memory of 3520	4560	Unicorn-14224.exe	93
PID 4824 wrote to memory of 2756	4824	Unicorn-33929.exe	94
PID 4824 wrote to memory of 2756	4824	Unicorn-33929.exe	94
PID 4824 wrote to memory of 2756	4824	Unicorn-33929.exe	94
PID 3536 wrote to memory of 3552	3536	Unicorn-24430.exe	95
PID 3536 wrote to memory of 3552	3536	Unicorn-24430.exe	95
PID 3536 wrote to memory of 3552	3536	Unicorn-24430.exe	95
PID 1952 wrote to memory of 3992	1952	Unicorn-10695.exe	96
PID 1952 wrote to memory of 3992	1952	Unicorn-10695.exe	96
PID 1952 wrote to memory of 3992	1952	Unicorn-10695.exe	96
PID 3692 wrote to memory of 3972	3692	Unicorn-42569.exe	97
PID 3692 wrote to memory of 3972	3692	Unicorn-42569.exe	97
PID 3692 wrote to memory of 3972	3692	Unicorn-42569.exe	97
PID 3728 wrote to memory of 5020	3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe	98
PID 3728 wrote to memory of 5020	3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe	98
PID 3728 wrote to memory of 5020	3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe	98
PID 2092 wrote to memory of 1500	2092	Unicorn-60384.exe	100
PID 2092 wrote to memory of 1500	2092	Unicorn-60384.exe	100
PID 2092 wrote to memory of 1500	2092	Unicorn-60384.exe	100
PID 5032 wrote to memory of 2680	5032	Unicorn-22231.exe	101
PID 5032 wrote to memory of 2680	5032	Unicorn-22231.exe	101
PID 5032 wrote to memory of 2680	5032	Unicorn-22231.exe	101
PID 3520 wrote to memory of 1088	3520	Unicorn-872.exe	104
PID 3520 wrote to memory of 1088	3520	Unicorn-872.exe	104
PID 3520 wrote to memory of 1088	3520	Unicorn-872.exe	104
PID 4560 wrote to memory of 4404	4560	Unicorn-14224.exe	105
PID 4560 wrote to memory of 4404	4560	Unicorn-14224.exe	105
PID 4560 wrote to memory of 4404	4560	Unicorn-14224.exe	105
PID 3552 wrote to memory of 3780	3552	Unicorn-58049.exe	106
PID 3552 wrote to memory of 3780	3552	Unicorn-58049.exe	106
PID 3552 wrote to memory of 3780	3552	Unicorn-58049.exe	106
PID 3536 wrote to memory of 920	3536	Unicorn-24430.exe	107
PID 3536 wrote to memory of 920	3536	Unicorn-24430.exe	107
PID 3536 wrote to memory of 920	3536	Unicorn-24430.exe	107
PID 2756 wrote to memory of 4896	2756	Unicorn-13679.exe	108
PID 2756 wrote to memory of 4896	2756	Unicorn-13679.exe	108
PID 2756 wrote to memory of 4896	2756	Unicorn-13679.exe	108
PID 1952 wrote to memory of 2020	1952	Unicorn-10695.exe	109
PID 1952 wrote to memory of 2020	1952	Unicorn-10695.exe	109
PID 1952 wrote to memory of 2020	1952	Unicorn-10695.exe	109
PID 3728 wrote to memory of 2024	3728	59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe	111

C:\Users\Admin\AppData\Local\Temp\59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe
"C:\Users\Admin\AppData\Local\Temp\59c15fbd95e901e511d1ed7b8a53f474ea0004eef0d16ff4722810954ecaf151N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33929.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14224.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16353.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17417.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
        9⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
        10⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        10⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        10⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
        10⤵
        
        PID:18292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2287.exe
        9⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14222.exe
        9⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        9⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23273.exe
        9⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54915.exe
        9⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
        8⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        9⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        9⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        9⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        9⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        9⤵
        
        PID:18152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38887.exe
        8⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8551.exe
        8⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        8⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4714.exe
        8⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        8⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57520.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        9⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        9⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        9⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        9⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        9⤵
        
        PID:17704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56200.exe
        8⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
        8⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
        8⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        8⤵
        
        PID:16856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
        8⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49351.exe
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36849.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        8⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        8⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
        8⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13306.exe
        8⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12183.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        7⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        7⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8619.exe
        7⤵
        
        PID:17152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        7⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5719.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43753.exe
        7⤵
        Executes dropped EXE
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64801.exe
        8⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3984.exe
        9⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        9⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        9⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
        9⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58120.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        8⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        8⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        8⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62315.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61753.exe
        8⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        8⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20962.exe
        8⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        8⤵
        
        PID:17852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        7⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12495.exe
        7⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        7⤵
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14995.exe
        7⤵
        
        PID:16796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4758.exe
        6⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50529.exe
        8⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55363.exe
        8⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
        8⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        8⤵
        
        PID:17816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10559.exe
        7⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33246.exe
        7⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10490.exe
        7⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
        7⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
        7⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25048.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
        7⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
        7⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        7⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28011.exe
        7⤵
        
        PID:17988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        7⤵
        
        PID:17668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21790.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
        6⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        6⤵
        
        PID:14716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        6⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54432.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60089.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39721.exe
        8⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45313.exe
        9⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        9⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        9⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        9⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29649.exe
        9⤵
        
        PID:18340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        8⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        8⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        8⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
        8⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43784.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        8⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44979.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13169.exe
        8⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        8⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22950.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4519.exe
        7⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        7⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        7⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56560.exe
        6⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        8⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        8⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19618.exe
        8⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        8⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        8⤵
        
        PID:17508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe
        7⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        7⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        7⤵
        
        PID:17692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52514.exe
        7⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exe
        6⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31239.exe
        7⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11537.exe
        7⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        7⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60316.exe
        6⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43753.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31937.exe
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5240.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
        8⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        8⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        8⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46178.exe
        8⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
        7⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12297.exe
        7⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50179.exe
        7⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
        7⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29367.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
        7⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13298.exe
        7⤵
        
        PID:17772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55815.exe
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59578.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16546.exe
        6⤵
        
        PID:16696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 632
        6⤵
        Program crash
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
        5⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36849.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        6⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        6⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
        6⤵
        
        PID:16668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
        6⤵
        
        PID:16952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        5⤵
        
        PID:10956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
        5⤵
        
        PID:16700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57483.exe
        5⤵
        
        PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10680.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51625.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        8⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6112.exe
        9⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33647.exe
        9⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30857.exe
        9⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        9⤵
        
        PID:17572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
        8⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        8⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        8⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5447.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        8⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        8⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        8⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
        8⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13114.exe
        8⤵
        
        PID:18388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        7⤵
        
        PID:11928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20465.exe
        7⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        7⤵
        
        PID:17588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        6⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21207.exe
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-871.exe
        8⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        8⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        8⤵
        
        PID:16632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
        8⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        7⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        7⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46708.exe
        7⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        6⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9496.exe
        7⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        7⤵
        
        PID:13704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
        7⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
        7⤵
        
        PID:18124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30456.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
        6⤵
        
        PID:14964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61643.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17535.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45673.exe
        6⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        8⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        8⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19618.exe
        8⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
        8⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        7⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
        7⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24913.exe
        7⤵
        
        PID:16924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
        7⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        6⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22396.exe
        7⤵
        
        PID:17164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        7⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16614.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15095.exe
        6⤵
        
        PID:12308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        6⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31182.exe
        5⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        6⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        7⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe
        7⤵
        
        PID:16844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46423.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        6⤵
        
        PID:15184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        6⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64002.exe
        6⤵
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38386.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        5⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
        5⤵
        
        PID:11632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12827.exe
        5⤵
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        5⤵
        
        PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55761.exe
        6⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        8⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
        8⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe
        8⤵
        
        PID:17600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        8⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        7⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26827.exe
        7⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        7⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46480.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63468.exe
        7⤵
        
        PID:17988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24590.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20465.exe
        6⤵
        
        PID:15240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50179.exe
        6⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
        5⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56065.exe
        6⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
        7⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exe
        7⤵
        
        PID:15348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
        7⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exe
        6⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
        6⤵
        
        PID:17072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58208.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50327.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        5⤵
        
        PID:13184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        5⤵
        
        PID:16404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        5⤵
        
        PID:18424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        5⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        7⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
        7⤵
        
        PID:18320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        6⤵
        
        PID:12244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        6⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        6⤵
        
        PID:17844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4591.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
        6⤵
        
        PID:12732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        6⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
        6⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41503.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15863.exe
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        5⤵
        
        PID:16136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13582.exe
      4⤵
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43947.exe
        6⤵
        
        PID:16512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15729.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        5⤵
        
        PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        5⤵
        
        PID:12276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20962.exe
        5⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        5⤵
        
        PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48855.exe
      4⤵
      PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52065.exe
        5⤵
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        5⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        5⤵
        
        PID:16912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6176.exe
      4⤵
      PID:8412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exe
      4⤵
      PID:12180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
      4⤵
      PID:15684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
      4⤵
      PID:17672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
      4⤵
      PID:6552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10695.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10488.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12512.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32321.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
        9⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe
        9⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
        9⤵
        
        PID:17292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
        8⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        8⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26827.exe
        8⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        8⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11502.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe
        7⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        7⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
        7⤵
        
        PID:18260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52616.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21977.exe
        8⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        8⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12897.exe
        8⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13298.exe
        8⤵
        
        PID:17660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
        8⤵
        
        PID:18120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        7⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4906.exe
        7⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13169.exe
        7⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        7⤵
        
        PID:14632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60023.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
        7⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        7⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47898.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6430.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59867.exe
        6⤵
        
        PID:15652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-265.exe
        6⤵
        
        PID:18036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23490.exe
        6⤵
        
        PID:17844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50592.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26081.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20337.exe
        8⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56896.exe
        8⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45938.exe
        8⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35203.exe
        8⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        7⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe
        7⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8193.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        7⤵
        
        PID:16568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12331.exe
        7⤵
        
        PID:17444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42951.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61898.exe
        6⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38687.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57633.exe
        7⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37770.exe
        7⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        7⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38778.exe
        7⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50159.exe
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64378.exe
        6⤵
        
        PID:12840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        6⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11923.exe
        6⤵
        
        PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1799.exe
        5⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7670.exe
        5⤵
        
        PID:10164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7539.exe
        5⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
        5⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52706.exe
        5⤵
        
        PID:7948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
        6⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34633.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16708.exe
        8⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28290.exe
        8⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32641.exe
        8⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43631.exe
        7⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
        7⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
        7⤵
        
        PID:18068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6443.exe
        7⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6703.exe
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exe
        6⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        7⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36146.exe
        7⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        7⤵
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13505.exe
        7⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32006.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21922.exe
        6⤵
        
        PID:15436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        6⤵
        
        PID:17756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
        6⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60023.exe
        5⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
        6⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59235.exe
        6⤵
        
        PID:17788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        6⤵
        
        PID:17872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        5⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5470.exe
        5⤵
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        5⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
        5⤵
        
        PID:17708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        5⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exe
        5⤵
        
        PID:17596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
        5⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8696.exe
        6⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        6⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        6⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49656.exe
        5⤵
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        5⤵
        
        PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49587.exe
        5⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        5⤵
        
        PID:16736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
        5⤵
        
        PID:17780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62188.exe
        5⤵
        
        PID:17440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38584.exe
      4⤵
      PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47705.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43631.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
        6⤵
        
        PID:16240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        6⤵
        
        PID:18056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25122.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        6⤵
        
        PID:17724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
        5⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7694.exe
        5⤵
        
        PID:12232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        5⤵
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        5⤵
        
        PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
      4⤵
      PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16217.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37770.exe
        5⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        5⤵
        
        PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5831.exe
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41361.exe
      4⤵
      PID:12752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
      4⤵
      PID:16152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
      4⤵
      PID:17652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 728
      4⤵
      Program crash
      PID:2612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 728
      4⤵
      Program crash
      PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18391.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55377.exe
        5⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
        7⤵
        
        PID:15620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59235.exe
        7⤵
        
        PID:17680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
        7⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        6⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        6⤵
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        6⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4591.exe
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-160.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25762.exe
        6⤵
        
        PID:13132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        6⤵
        
        PID:15500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46178.exe
        6⤵
        
        PID:17708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57839.exe
        5⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        5⤵
        
        PID:12760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        5⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9323.exe
        5⤵
        
        PID:17808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42281.exe
        5⤵
        
        PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
      4⤵
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        5⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        5⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
        5⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33563.exe
        5⤵
        
        PID:17356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
        5⤵
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
      4⤵
      PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36886.exe
      4⤵
      PID:10428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49482.exe
      4⤵
      PID:14760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe
      4⤵
      PID:16532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20494.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38849.exe
      4⤵
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
        5⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        5⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        5⤵
        
        PID:13144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        5⤵
        
        PID:17956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
      4⤵
      PID:9412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
      4⤵
      PID:13796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
      4⤵
      PID:16880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
      4⤵
      PID:16708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
    3⤵
    PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
      4⤵
      PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
      4⤵
      PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
      4⤵
      PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
      4⤵
      PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
    3⤵
    PID:7392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44422.exe
    3⤵
    PID:10072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7378.exe
    3⤵
    PID:13572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24002.exe
    3⤵
    PID:16660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24459.exe
    3⤵
    PID:17732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22231.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22231.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60384.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9144.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26353.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
        8⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        9⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55779.exe
        9⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4377.exe
        9⤵
        
        PID:18184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        8⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        8⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        8⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21207.exe
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29204.exe
        8⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59235.exe
        8⤵
        
        PID:17764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
        8⤵
        
        PID:18192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe
        7⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
        7⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
        7⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        7⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10383.exe
        7⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        7⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        7⤵
        
        PID:17620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        7⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55048.exe
        6⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36222.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43618.exe
        6⤵
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
        8⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
        8⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        8⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13889.exe
        8⤵
        
        PID:18108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        7⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19618.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
        7⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
        6⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
        7⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41666.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12050.exe
        7⤵
        
        PID:1348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41311.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        6⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        6⤵
        
        PID:17796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26905.exe
        6⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25033.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-459.exe
        7⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
        7⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45627.exe
        7⤵
        
        PID:17576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        6⤵
        
        PID:12768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        6⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exe
        6⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44752.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65423.exe
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17178.exe
        5⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
        5⤵
        
        PID:16676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe
        5⤵
        
        PID:17744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
        5⤵
        
        PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30991.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58745.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49169.exe
        8⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        8⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        8⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62706.exe
        8⤵
        
        PID:17996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43631.exe
        7⤵
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
        7⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        7⤵
        
        PID:18180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        7⤵
        
        PID:14704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe
        6⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
        6⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
        6⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
        6⤵
        
        PID:17832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46708.exe
        6⤵
        
        PID:18104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        6⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        6⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
        6⤵
        
        PID:16744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13505.exe
        6⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47159.exe
        5⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59392.exe
        5⤵
        
        PID:10984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25073.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        5⤵
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46559.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29633.exe
        5⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36849.exe
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38343.exe
        6⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19025.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
        6⤵
        
        PID:16728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
        6⤵
        
        PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        5⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        5⤵
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        5⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        5⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        5⤵
        
        PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47048.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13408.exe
        5⤵
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        5⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        5⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5145.exe
        5⤵
        
        PID:7720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20150.exe
      4⤵
      PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
      4⤵
      PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
      4⤵
      PID:14676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
      4⤵
      PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
        8⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        8⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
        8⤵
        
        PID:18312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        7⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        7⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        7⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
        6⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49587.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        6⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38540.exe
        6⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18895.exe
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28297.exe
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        6⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55187.exe
        6⤵
        
        PID:16800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
        6⤵
        
        PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        5⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        5⤵
        
        PID:13940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        5⤵
        
        PID:17136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8703.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18297.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        7⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe
        7⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50159.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24507.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        6⤵
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        6⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
        5⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4031.exe
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65146.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8362.exe
        5⤵
        
        PID:17368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
        5⤵
        
        PID:10832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        5⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        5⤵
        
        PID:12316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4066.exe
        5⤵
        
        PID:15772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11887.exe
      4⤵
      PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65423.exe
      4⤵
      PID:9828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17178.exe
      4⤵
      PID:13620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
      4⤵
      PID:16640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
      4⤵
      PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58760.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30401.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5240.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        6⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        6⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4377.exe
        6⤵
        
        PID:18272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10455.exe
        5⤵
        
        PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        5⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2785.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
        6⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46178.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        5⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63723.exe
        5⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
        5⤵
        
        PID:17304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exe
      4⤵
      PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41224.exe
      4⤵
      PID:10196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
      4⤵
      PID:13660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29986.exe
      4⤵
      PID:16788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exe
      4⤵
      PID:18244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35794.exe
      4⤵
      PID:18056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54521.exe
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        5⤵
        
        PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exe
        5⤵
        
        PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57824.exe
      4⤵
      PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
      4⤵
      PID:9420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
      4⤵
      PID:16848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
    3⤵
    PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe
      4⤵
      PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
      4⤵
      PID:11648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
      4⤵
      PID:4376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
    3⤵
    PID:7592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
    3⤵
    PID:10676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1234.exe
    3⤵
    PID:14416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:17352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
    3⤵
    PID:18248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58049.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        6⤵
        
        PID:112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        7⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37425.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55064.exe
        8⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        8⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61819.exe
        8⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11194.exe
        8⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        7⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        7⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        7⤵
        
        PID:17120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35423.exe
        6⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3792.exe
        7⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64000.exe
        7⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44490.exe
        7⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        6⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        6⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
        6⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
        5⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15793.exe
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41297.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37770.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        7⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        7⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42271.exe
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
        6⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
        6⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe
        5⤵
        
        PID:6500
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6500 -s 464
        6⤵
        Program crash
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        5⤵
        
        PID:220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-282.exe
        5⤵
        
        PID:14820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60316.exe
        5⤵
        
        PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
        5⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15985.exe
        6⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        7⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
        7⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
        7⤵
        
        PID:17208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10559.exe
        6⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33246.exe
        6⤵
        
        PID:11412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        6⤵
        
        PID:15044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
        6⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11502.exe
        5⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
        5⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        5⤵
        
        PID:15900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        5⤵
        
        PID:18212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47903.exe
      4⤵
      PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        5⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        6⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        6⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        6⤵
        
        PID:13556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
        6⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13313.exe
        6⤵
        
        PID:14652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe
        5⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36999.exe
        5⤵
        
        PID:11084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        5⤵
        
        PID:13932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        5⤵
        
        PID:17128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        5⤵
        
        PID:18384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6215.exe
      4⤵
      PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44016.exe
        5⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20961.exe
        5⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49915.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
        5⤵
        
        PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46383.exe
      4⤵
      PID:8604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
      4⤵
      PID:11988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28588.exe
      4⤵
      PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37505.exe
        5⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7088.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53915.exe
        7⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63738.exe
        7⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
        7⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
        7⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20962.exe
        6⤵
        
        PID:14364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45625.exe
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
        6⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54418.exe
        6⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
        6⤵
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
        5⤵
        
        PID:9660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
        5⤵
        
        PID:11980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        5⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33783.exe
      4⤵
      PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        5⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18271.exe
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        6⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36651.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        5⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32006.exe
        5⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
        5⤵
        
        PID:14368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        5⤵
        
        PID:16580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12155.exe
        5⤵
        
        PID:17948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32662.exe
      4⤵
      PID:12776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60059.exe
      4⤵
      PID:16116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22910.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe
      4⤵
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15985.exe
        5⤵
        
        PID:5780
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 624
        6⤵
        Program crash
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        5⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        5⤵
        
        PID:11468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26827.exe
        5⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        5⤵
        
        PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
      4⤵
      PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26913.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25203.exe
        5⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        5⤵
        
        PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24590.exe
      4⤵
      PID:9184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
      4⤵
      PID:11936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe
      4⤵
      PID:15400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8649.exe
      4⤵
      PID:4004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
    3⤵
    PID:436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
      4⤵
      PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45313.exe
        5⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39791.exe
        5⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        5⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        5⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
        5⤵
        
        PID:18068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9599.exe
      4⤵
      PID:8232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
      4⤵
      PID:11540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
      4⤵
      PID:7944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
    3⤵
    PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11608.exe
      4⤵
      PID:10532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exe
      4⤵
      PID:14396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
      4⤵
      PID:17388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
    3⤵
    PID:9428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
    3⤵
    PID:13040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35754.exe
    3⤵
    PID:16264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10488.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13768.exe
        5⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56833.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47041.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        7⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45938.exe
        7⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35203.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        7⤵
        
        PID:17740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24118.exe
        6⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50371.exe
        6⤵
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-217.exe
        6⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29287.exe
        5⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        5⤵
        
        PID:12856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
        5⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
        5⤵
        
        PID:18108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59001.exe
        5⤵
        
        PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
      4⤵
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        5⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        5⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        5⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        5⤵
        
        PID:16320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38887.exe
      4⤵
      PID:7532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
      4⤵
      PID:14228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8619.exe
      4⤵
      PID:17104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25895.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38849.exe
      4⤵
      PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
        6⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        6⤵
        
        PID:13832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
        6⤵
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        6⤵
        
        PID:18356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5306.exe
        5⤵
        
        PID:15424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11194.exe
        5⤵
        
        PID:17140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
      4⤵
      PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8554.exe
      4⤵
      PID:13644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
      4⤵
      PID:16716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28260.exe
      4⤵
      PID:6528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
    3⤵
    PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
      4⤵
      PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24193.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        5⤵
        
        PID:12544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23209.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
      4⤵
      PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exe
      4⤵
      PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
      4⤵
      PID:16220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
      4⤵
      PID:18096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
      4⤵
      PID:17664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26309.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51576.exe
    3⤵
    PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24006.exe
    3⤵
    PID:10200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
    3⤵
    PID:13088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45132.exe
    3⤵
    PID:15820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
    3⤵
    PID:18088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26575.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26575.exe
    3⤵
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33089.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        5⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        5⤵
        
        PID:14844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        5⤵
        
        PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8255.exe
      4⤵
      PID:8044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55447.exe
      4⤵
      PID:10512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24331.exe
      4⤵
      PID:15008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
      4⤵
      PID:16652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
    3⤵
    PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
      4⤵
      PID:8420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
      4⤵
      PID:12824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38554.exe
      4⤵
      PID:16048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
      4⤵
      PID:17632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
    3⤵
    PID:9136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
    3⤵
    PID:11872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
    3⤵
    PID:14800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1707.exe
    3⤵
    PID:5944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20295.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20295.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14344.exe
    3⤵
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
      4⤵
      PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
      4⤵
      PID:10040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
      4⤵
      PID:13012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
      4⤵
      PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62660.exe
      4⤵
      PID:5124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
    3⤵
    PID:7556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
    3⤵
    PID:9100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
    3⤵
    PID:13668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
    3⤵
    PID:16960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
    3⤵
    PID:17980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
  2⤵
  PID:5216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
    3⤵
    PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
      4⤵
      PID:10596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19042.exe
      4⤵
      PID:14136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
      4⤵
      PID:17312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30915.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
    3⤵
    PID:9608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41034.exe
    3⤵
    PID:12504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
    3⤵
    PID:15956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exe
  2⤵
  PID:10056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18786.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18786.exe
  2⤵
  PID:13924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53827.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53827.exe
  2⤵
  PID:16940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe
  2⤵
  PID:7204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3972 -ip 3972
1⤵
PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3972 -ip 3972
1⤵
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4004 -ip 4004
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6500 -ip 6500
1⤵
PID:6252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5780 -ip 5780
1⤵
PID:8668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:5428

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10488.exe

Filesize
468KB

MD5
7cb59d42f3304ba39b77dc0c2e2a9963

SHA1
454582d207f7a09c98564a3c98640a7777ad5052

SHA256
bfd7366846d4b7172084ed58bb72ce9dfc9a64643707ee4683f2fafa25fdc2f2

SHA512
91ef2cc5469e6497182e420a9cf112f90dd02fb2c1b49796a1c4e2c60a63c8386cbf6cd4e04f889b121ca1c17727139aec44e98bf94467f7e6bed893fb6abf72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10680.exe

Filesize
468KB

MD5
d835621b55e021bed4fbd34bb776e427

SHA1
dc4cbcdcc71989ae2b2dae80ce28b120b285107a

SHA256
1925055a872cac48e93b147ffacbd222912baef5f4a11e7732edc176b79f9c17

SHA512
9249e1b1fd442811ecb49bdd9cd784632e0c5041fc3457ad6eb4b05dd951b847d3652df808a6ad7ad8d942c088c95c2e73516ad2d48615cf1acf5cf444c99797

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10695.exe

Filesize
468KB

MD5
45c23e85a3b7ace7839b222d6ca7b696

SHA1
4cbdc272090c72f9caa0ba0b2757f9b7917206bd

SHA256
bede124940db1de61054b3f7e698d6d4955e1bfdc591e8b4820161b96d8522e0

SHA512
cc86f1a8f855059db0c8fb5767a76dd89e94612782e8b806849377de8dd99dc7ff15c4f37e2cf2053313bb21864ebe57ce288bc3a01d730e05014bb97954da86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe

Filesize
468KB

MD5
f564f12dd793a38bc17c0030643f058f

SHA1
b9b59f17e7850d2ad294ffde0c4abe6f3ceec3d3

SHA256
505c8a499e9b742df83b0a4667bf72fd4111c3bc587802e9ff4413b6148821d9

SHA512
bfc0a6d265c89d1c9515b54eded2a80f9f26a82a7b53b880961b2e0382c0db299a2917fcef9dced0ea32982ae8a7340a862273df3688fc21b6f9bf7271cb4e98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe

Filesize
468KB

MD5
9d3152afc1abfde732d0480940406c5c

SHA1
647987b4c000cbc2651a00ce2b993d8c740856c0

SHA256
0f5e2bcb05b5483cc357ddbaaf32a07c507b4a6cde7459c5cd6d8170d791e25f

SHA512
598590c217d95c7a23884647d34f35cf6736255b68602b49c6e9f234d03f2c9261eaa16a187193e2f598b3a27d6756db0410747f192a8ab05b434bccf5508960

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14224.exe

Filesize
468KB

MD5
38e6751bd66d8417121eae409bb14118

SHA1
5cd515c8db8fcb79428004ecfb73481f937c0dd8

SHA256
b6676b381d0f99e5cb5b3bb1fab4c96a6c2460621bf023e180fb24cc0ebc47c0

SHA512
3cf57b40a69c081d9a66bba1e9736aa0a2398e3bbfdde2787273a53c7b235eb82de825946a2b25c76f3bad839056f6bd30596a1543bca338ee55fca1e393dd47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe

Filesize
468KB

MD5
9b940da111ea35ab2620c2859006296c

SHA1
637afb31bff37b878350bc6e7d5d6c4363ae238f

SHA256
d0b08469e73148c93843e74e16b339c09f89c83b09504ef9e2828e771e44f1ad

SHA512
d75446188260bc2ccb5a66b8d70bf2d92ac6b092724851bf0b75b060e6d63dd76026cab175c91bce007d7fff57aefef1150f7aeaf3451141018adc922467a167

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16353.exe

Filesize
468KB

MD5
ba0322b917345a04cfc6f750162d1e4f

SHA1
25aa9e8bba9ae5403a326c9f700aec5a3c77dd39

SHA256
45d66cfa3e46baf919dfae8025a993f2576a71e8beb4acf4ef22037011735baa

SHA512
d37a3ca94bac449a7d41d9592e080f3fc1c759ab164d0de749be346dbb2c960c1c85dd09a2adc3e02a43974a449b9b766f1997a40b5d9c2d255ca91273529e37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17417.exe

Filesize
468KB

MD5
ffe9e65d263496e0f0dd685b45c86788

SHA1
0f8387e0413e018687a8ab2d82233764e321b15d

SHA256
22e78a69d7d9bf9d3c79c8c9e51c43159f420021bdc1b5f3738755add5de1a38

SHA512
d588f8f8555b797a672122df8896e33a1c35937f9137749f03090732da8fb8a8a16679ea4c043b2cd4424d2446f79c7b24f4f7116c7219aedaf793c9e1d60bb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18391.exe

Filesize
468KB

MD5
cc68abe9697f792482a85369741d09ab

SHA1
50a77c6d92733e9fe75c06c9bacced96ecdac872

SHA256
274b8d194315b5f852de64b5c1a952179db469fd4b31122f226acc169195619d

SHA512
95449e76f1adcbe84e56ab2057d3a5ed859fab2335f1dfd5da418040a988f3916eb188e4027ba658fbca698717be818fd219b6369d9d2cb26346b734692e1365

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22231.exe

Filesize
468KB

MD5
398e2d0fecb0d0373db92f24acd192d1

SHA1
3c714250eb0461857592a861cdd61cda667651c2

SHA256
1d328efab9b5dd44b7a1f5c9506cba9e491b34e2474e454d0f9e539b82aaa4ee

SHA512
eda31d7a8cd8bea5fcc6c90a883c3b984af0235c6f5de9b0cf60a4998a4567fe7fe7f048c7e8a89c7963532d9aa7e2bfa7785508e5490d7baa11056f5292dc45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe

Filesize
468KB

MD5
ba3b410bdba435eaa6023e9e923494bb

SHA1
9d1ba64f8c52f3d96374904670d595addada16ae

SHA256
4839946276cdc5347200dc899b4fa35a4e0033404f38b4933cc3bd48926457c3

SHA512
eb92fdc54cdf6b6f170648d302504b455d8e04535b812d1b01564f13a7868d57cd949797b4283a286435fd39bb95248aa1c8ed8a0226968cb47d1a9f182a385f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26353.exe

Filesize
468KB

MD5
5d5f66d86043783e70668e9dc360b56c

SHA1
6aaebe3b9e5dddd6dafed504ba82833583ec917f

SHA256
705e7072191e770da055f6a0663510c65eab89736e568bca9ed7731d74fad0db

SHA512
37ae37eaece52c26619a240cf968a21ed91b3de1b71b0e19386404e0848cceeda258004699049402ef11ce127c724d7305af747ba0b294592878ae2e91a78135

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30991.exe

Filesize
468KB

MD5
4ba12c63756f82cb35dd5dd82af94ed7

SHA1
a66ae783c887e6f4d00d4e5848233f7cfa5f9c2b

SHA256
de3f0c3f78c4cf58ac35ee7cfd4e974ebdeb3857b5cdec3b50345142a94e1a67

SHA512
98e2992d508d6f26e4fd3da707b13f68976a93516a1d97d8c959c61d6e05bca240ea9f0ae19da8f87a5a41b605c8096f397230ec60a8c59ae3fc946cc79355c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33929.exe

Filesize
468KB

MD5
42c98c09bb57e3362db4907c8c231264

SHA1
8cb9a87a3060e6468a1ac2539f7a7262d539c54f

SHA256
1eb778a7ab49faa2ae8ab1ce1a4b81694e6370687f9483311a17a219621eb90a

SHA512
039197837acd4b8cb98e87c13a7c0662ac2513bde9d24d1c519eee8cb79b0afb098759d72bec9318a493f9cbafea2bf39423b96a5eefe787833580f53994215e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe

Filesize
468KB

MD5
afdf2491b0a734e2e8843e163ae4adaf

SHA1
123ccb8ba15d45a85aa591d25413b69dd1ae3863

SHA256
fc89d01cacb8b20aa0d75f89043d138df51d8d8a1645a5d53f64801974b6f858

SHA512
0866e99aa52feb396c47849d71a1bca00c689691d7ef1d268c5d3c48626ab26a854c314ffb8ba350972a138195b66b7db7c47fd45ca68df10f40ee37da70bc48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe

Filesize
468KB

MD5
a727228369f558939efcf2b39396a81f

SHA1
bf41dc8f29a1c9f2251f68d044b5905a9b2ab31c

SHA256
143a601f4b52eea63ed980d1feb8eae9642f1786bf4a5cbb81d61c5c7eed5eb7

SHA512
bf2c8aabdba08fc8fdf4b639db1ff4084c2cd000c5ad0b248a3ab8a3aabf5b4f0cca3e87b48200a1fe2eb3c4c9c72cdb35eec9a6f19dc524ccbe3927b8b295fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe

Filesize
468KB

MD5
566a94023026d316ae6374cd2e995285

SHA1
207ef38f4cf66f2f467efa4a44c9cfa77b04d902

SHA256
7c04cb0d339e0b5f456b27e8768b4ee5e2eb5c5de2cad11545650913dafde625

SHA512
b070617f5ef54c2bed6cc25d1daeac210ccac498f80a495d876ae2b9607ad40278bb2474d447d1fe2d26d0f711784418638993b6c360122c01682a545d44c4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe

Filesize
468KB

MD5
fbedd816036edad6ca6ed75f8df1e3b2

SHA1
eda52f46b135aef2c3da1a263f4dcbe120b6e9be

SHA256
e3bcd6c5f61d1d73573e8c22f7f42c5dfb6d6706106931445b3ba3f26f47cfa0

SHA512
259695f396217ca1bb5d23d3e17bd8f135a1e37acbd2466face68f4f39a697343da623f9e0512e129b47d979be56bd590a02a5b2188e8276fdd926960951bb28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe

Filesize
468KB

MD5
91e7afd4453b31d690248d7b6dfd2b6c

SHA1
c1423d10ae100a4708cb8136af14c0d6fd343bcf

SHA256
6fc550b8db6dfafb5f0e80632a73c337df18a9c6048fd559bf41ac763859001a

SHA512
8517611df1a0a31a0bbd239bd16e826a660d394a0b962a03473c1fcc90954227ed3516114c46aadf5dec5049da8dc2d2bbe86a4be90491bbfcd92fbda4d0f5de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe

Filesize
468KB

MD5
fde14e05fb6d99b4a3edff201aa0287a

SHA1
d51bbf5c6ac82ab9db9cda6fa6f21d17ddd35f3b

SHA256
e3e2fc7127e266d55fb4fba9cb8cafea8ace51d4847d26c44e7b68d2b07298aa

SHA512
f055670a70d805265e4044304bef4c8370929196fd5e174467be1dc4fcb797aa927c583bbcbd756f171f2e5ded06b0e4072102e11a554a8dccc13cc134557b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe

Filesize
468KB

MD5
a0807dcc1d5e302a9c6e5731317f7359

SHA1
6582428ad68578120e769cf3e4b7d9cb7f52702a

SHA256
4fd67ec17b27296253b736278c661db3aed9429c898e950d74b3a186c1746b7b

SHA512
ff67bbcba168b7d7709ada41999917c4aefefca6001dea26b5882ac3fab80b33d0dbd7c6bac2a916a9cd505ec8a24fffaa7fedab1ba124c5149913e32141e040

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54432.exe

Filesize
468KB

MD5
67bc5278766fba11f4c86bec5ee5abb5

SHA1
10b20c59297458dfe7db78f9abb06ad878c92d16

SHA256
4cd4acda453dcfa3afadfe9e26acb47fb86e3f090a2ed58b6d410c825b0f45b0

SHA512
7ab979f849d5e67fed77cd1dcf7b8bac6a32844b007cca905883e0991615f9ef93d077b9f58b7e943092c9ba0d454f77bdba9ca96d4e4e9d2bb2c8df01b1876f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe

Filesize
468KB

MD5
733b649812541bb96a5fbe16a90a7f90

SHA1
0a48b2099f24da6d979489929c59475cdcaa68d9

SHA256
906533559a8e4416c882f2b9bce061b9da41012648b6c5a2a32f20d4ebf4afd4

SHA512
c2dd135056e42628372a6a23dfaebcf0388559775953c287d8a03b327c3c4bbccce69b47b05aa5abb1f04377dee7c181bed8e7d041d808ffba30becf8aa9b6e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5719.exe

Filesize
468KB

MD5
7188d2103ea76e27c8664e2a7727099b

SHA1
2fff6789e8b13bc8eecd942e5616853d7516299a

SHA256
0d67801ccf4171e87f5a870807f6cd7cf2cc30aa7278497a459308259a261d87

SHA512
624c55ed6ba7b5709fcb80ceae5ec42768135ef86aeb940d47b29a5e441b1d343ab4d9a8879e63759fe5c635c61080d93b83701fb893f8ae3f4e90c54adae686

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58049.exe

Filesize
468KB

MD5
9c2e04f6e7addaf7f7d194a02768e823

SHA1
b07232d1ad2a391e3f9c87b11aba902d4f8d3c07

SHA256
71f587ca88b376d64a1acad53f075d2f9cfca2c2b1f3eb472e0cffdf04ff5233

SHA512
85c0054feb568d0c67b8aa322a907c8286c0ed6bb2abbd1e696f0c7f84677087543387a3711cc60f838fabaaa8f7c1e6d83fc2922e4a85b7037bf445a2dc9e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe

Filesize
468KB

MD5
65d59dde4ef53d78b654e35204b7599e

SHA1
7649cbf8ffeb4fb37134bfecb88b9104f4ebdd82

SHA256
dc80eb9bfba1b82a89bbe323db2ac735be201b0ed6ed60b96c7bfaec7fca2a24

SHA512
6fd29d76a53245a7e0a7962d7dbe0ec9dbe338019ce1d19d254b33fdb911bf250dc03d996f162cc4aba81c9d337a7f679738c5506d4f307e246f288aee855d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58760.exe

Filesize
468KB

MD5
affc3c5c8b93decef3f21cf30c2d2f80

SHA1
f78c3de70c2439d701e93f6e4cc10d4097e43d00

SHA256
75364b31b3fcd2961f0fcca03586e81fcbdbbfb9cd40711ad705fbcf839e71ae

SHA512
509c2feca565ceb3e959e87c8ebeae32133b33ad22a4cb046c805050ad94943097fdb48d9a38ba00d8db599b94653a885ad3a590f85c6d16670762a4c9d97ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60384.exe

Filesize
468KB

MD5
1b913e0969d2ddc9a795fa081b54591f

SHA1
6cb797eacc3ef9ed420fcededc5a724ad53caabb

SHA256
0730a575ca17c26ce37f1307a4437a4365b0d8daa30286844ab6e2e01f1f3e6a

SHA512
7b99035999b6eecbd93e793d683df2e15945cb5032f850640991e82c4fdfd1b2b0e8ab8471f54605fa11a39d9a62de56c7683648971cd54dde93cc389d94c2bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe

Filesize
468KB

MD5
04b9dd53546a281a47eeb007f43e15a1

SHA1
185dde46699dad68a6afd5c1369a686e3bd6c755

SHA256
70e1ce151489cc25687b9ef7d6625be88e3970e7b73786f36b345d8f78043642

SHA512
087db0c2296422fbff2ec40c1c667be6dbd66b13719ee721468174eca9c44ae83ad55223bb6504ade0f018baa4945e5087494d904ae9165d8f9ab9dda1043e21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe

Filesize
468KB

MD5
d1df9a31b3bc161bb9c0e803158a380f

SHA1
2f8ee51979f98a1f8f0864ebb5b9b2de7ce6a71d

SHA256
a2ec6409b701d56d9eb1347c48e27f92fa2394abcb1a56203c99b4eec4f87974

SHA512
6a247c1c24f158f020ed644b58a3ae0a3b24e088b41daf90cad6301a933527be6b730c39d2aaa0f0b47c38de83fd799647b493d573231af8a7230e2eb7f47e5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9144.exe

Filesize
468KB

MD5
8d16d2067718309f3801b33a69b5d0f8

SHA1
f0d27345f5355b08ed3646bb5bf0009ac482b29b

SHA256
b59651e809059ca180381e02b83ea1d355ff7d0b49e8e1e10827ab238ba5d67f

SHA512
ce08579dfffe55bf4bb4a7a5525aea065a19f5ad6202bb254af0ff30e0c04b2fd7ccfa412fe107491e924286ec25c02f39017d6a14e171a6f4248215f8dec3c4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads