cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ce

Analysis

max time kernel
120s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe
Size

468KB
MD5

f2921adbee79a82944f3ee493937c100
SHA1

7d7233bb16dde80a999e3bb6d4484cb53d77968c
SHA256

cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ce
SHA512

f6024b30ee6ea45ada5bc07a9e39dc0d2f6b4a884425f8498e42a760f80abc43061d6195b5f398458819d8adeffba6d6a648996f1c166eca63e1523b84c2d2ad
SSDEEP

3072:WudSogdEIc5AHbYbzfjcff8wAaKB4pnlfEHCgdSCaZukhYSD9Af/:WuUoE0AHwzrcffdB9eaZ/iSD9

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4156	Unicorn-54789.exe
1472	Unicorn-65161.exe
3352	Unicorn-10527.exe
3440	Unicorn-22009.exe
2168	Unicorn-47338.exe
2972	Unicorn-53353.exe
5016	Unicorn-26304.exe
2192	Unicorn-25240.exe
2080	Unicorn-55049.exe
1416	Unicorn-8855.exe
2072	Unicorn-24929.exe
3236	Unicorn-50753.exe
4720	Unicorn-50488.exe
4044	Unicorn-30887.exe
3736	Unicorn-36917.exe
2380	Unicorn-51263.exe
4428	Unicorn-51263.exe
4876	Unicorn-36134.exe
2496	Unicorn-16533.exe
2528	Unicorn-20015.exe
2552	Unicorn-36621.exe
3560	Unicorn-55846.exe
2980	Unicorn-55846.exe
3648	Unicorn-49716.exe
3172	Unicorn-35980.exe
4312	Unicorn-35980.exe
4984	Unicorn-54326.exe
3112	Unicorn-47991.exe
452	Unicorn-50791.exe
2480	Unicorn-21925.exe
2132	Unicorn-15073.exe
2188	Unicorn-59377.exe
2000	Unicorn-51684.exe
4572	Unicorn-28405.exe
3296	Unicorn-8539.exe
1808	Unicorn-12020.exe
372	Unicorn-9924.exe
4568	Unicorn-28183.exe
3100	Unicorn-28183.exe
3772	Unicorn-6797.exe
2516	Unicorn-20532.exe
3624	Unicorn-65510.exe
3968	Unicorn-54575.exe
1028	Unicorn-65089.exe
2316	Unicorn-46110.exe
4780	Unicorn-57791.exe
2692	Unicorn-38190.exe
3416	Unicorn-58056.exe
4612	Unicorn-51926.exe
4412	Unicorn-51926.exe
4504	Unicorn-58056.exe
1524	Unicorn-58056.exe
4644	Unicorn-43503.exe
4448	Unicorn-18302.exe
1480	Unicorn-23902.exe
976	Unicorn-23902.exe
4380	Unicorn-16105.exe
1672	Unicorn-51818.exe
1528	Unicorn-6146.exe
924	Unicorn-56097.exe
412	Unicorn-31468.exe
2332	Unicorn-42370.exe
4528	Unicorn-22707.exe
2684	Unicorn-22707.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
8352	5560	WerFault.exe	218
3012	6820	WerFault.exe	265
14708	7776	WerFault.exe	325
15108	14836	WerFault.exe	724
13828	15624	WerFault.exe	755
16296	15488	WerFault.exe	743

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30429.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18736	dwm.exe
Token: SeChangeNotifyPrivilege	18736	dwm.exe
Token: 33	18736	dwm.exe
Token: SeIncBasePriorityPrivilege	18736	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4960	cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe
4156	Unicorn-54789.exe
1472	Unicorn-65161.exe
3352	Unicorn-10527.exe
2168	Unicorn-47338.exe
2972	Unicorn-53353.exe
3440	Unicorn-22009.exe
5016	Unicorn-26304.exe
2192	Unicorn-25240.exe
2080	Unicorn-55049.exe
1416	Unicorn-8855.exe
2072	Unicorn-24929.exe
4044	Unicorn-30887.exe
3236	Unicorn-50753.exe
4720	Unicorn-50488.exe
3736	Unicorn-36917.exe
2380	Unicorn-51263.exe
4428	Unicorn-51263.exe
2496	Unicorn-16533.exe
4876	Unicorn-36134.exe
2552	Unicorn-36621.exe
2528	Unicorn-20015.exe
2980	Unicorn-55846.exe
3172	Unicorn-35980.exe
3112	Unicorn-47991.exe
3560	Unicorn-55846.exe
4312	Unicorn-35980.exe
452	Unicorn-50791.exe
3648	Unicorn-49716.exe
4984	Unicorn-54326.exe
2480	Unicorn-21925.exe
2132	Unicorn-15073.exe
2188	Unicorn-59377.exe
2000	Unicorn-51684.exe
4572	Unicorn-28405.exe
3296	Unicorn-8539.exe
1808	Unicorn-12020.exe
372	Unicorn-9924.exe
3100	Unicorn-28183.exe
2516	Unicorn-20532.exe
3772	Unicorn-6797.exe
4568	Unicorn-28183.exe
3624	Unicorn-65510.exe
1028	Unicorn-65089.exe
2316	Unicorn-46110.exe
4448	Unicorn-18302.exe
3968	Unicorn-54575.exe
4780	Unicorn-57791.exe
4412	Unicorn-51926.exe
976	Unicorn-23902.exe
1480	Unicorn-23902.exe
1524	Unicorn-58056.exe
2692	Unicorn-38190.exe
3416	Unicorn-58056.exe
4644	Unicorn-43503.exe
4612	Unicorn-51926.exe
4504	Unicorn-58056.exe
4380	Unicorn-16105.exe
1672	Unicorn-51818.exe
924	Unicorn-56097.exe
1528	Unicorn-6146.exe
412	Unicorn-31468.exe
2332	Unicorn-42370.exe
2684	Unicorn-22707.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4156	4960	cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe	82
PID 4960 wrote to memory of 4156	4960	cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe	82
PID 4960 wrote to memory of 4156	4960	cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe	82
PID 4156 wrote to memory of 1472	4156	Unicorn-54789.exe	83
PID 4156 wrote to memory of 1472	4156	Unicorn-54789.exe	83
PID 4156 wrote to memory of 1472	4156	Unicorn-54789.exe	83
PID 4960 wrote to memory of 3352	4960	cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe	84
PID 4960 wrote to memory of 3352	4960	cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe	84
PID 4960 wrote to memory of 3352	4960	cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe	84
PID 1472 wrote to memory of 3440	1472	Unicorn-65161.exe	89
PID 1472 wrote to memory of 3440	1472	Unicorn-65161.exe	89
PID 1472 wrote to memory of 3440	1472	Unicorn-65161.exe	89
PID 4156 wrote to memory of 2168	4156	Unicorn-54789.exe	90
PID 4156 wrote to memory of 2168	4156	Unicorn-54789.exe	90
PID 4156 wrote to memory of 2168	4156	Unicorn-54789.exe	90
PID 3352 wrote to memory of 2972	3352	Unicorn-10527.exe	91
PID 3352 wrote to memory of 2972	3352	Unicorn-10527.exe	91
PID 3352 wrote to memory of 2972	3352	Unicorn-10527.exe	91
PID 4960 wrote to memory of 5016	4960	cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe	92
PID 4960 wrote to memory of 5016	4960	cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe	92
PID 4960 wrote to memory of 5016	4960	cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe	92
PID 2168 wrote to memory of 2192	2168	Unicorn-47338.exe	94
PID 2168 wrote to memory of 2192	2168	Unicorn-47338.exe	94
PID 2168 wrote to memory of 2192	2168	Unicorn-47338.exe	94
PID 4156 wrote to memory of 2080	4156	Unicorn-54789.exe	95
PID 4156 wrote to memory of 2080	4156	Unicorn-54789.exe	95
PID 4156 wrote to memory of 2080	4156	Unicorn-54789.exe	95
PID 3440 wrote to memory of 1416	3440	Unicorn-22009.exe	96
PID 3440 wrote to memory of 1416	3440	Unicorn-22009.exe	96
PID 3440 wrote to memory of 1416	3440	Unicorn-22009.exe	96
PID 1472 wrote to memory of 2072	1472	Unicorn-65161.exe	97
PID 1472 wrote to memory of 2072	1472	Unicorn-65161.exe	97
PID 1472 wrote to memory of 2072	1472	Unicorn-65161.exe	97
PID 2972 wrote to memory of 3236	2972	Unicorn-53353.exe	98
PID 2972 wrote to memory of 3236	2972	Unicorn-53353.exe	98
PID 2972 wrote to memory of 3236	2972	Unicorn-53353.exe	98
PID 4960 wrote to memory of 4720	4960	cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe	99
PID 4960 wrote to memory of 4720	4960	cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe	99
PID 4960 wrote to memory of 4720	4960	cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe	99
PID 3352 wrote to memory of 4044	3352	Unicorn-10527.exe	100
PID 3352 wrote to memory of 4044	3352	Unicorn-10527.exe	100
PID 3352 wrote to memory of 4044	3352	Unicorn-10527.exe	100
PID 5016 wrote to memory of 3736	5016	Unicorn-26304.exe	103
PID 5016 wrote to memory of 3736	5016	Unicorn-26304.exe	103
PID 5016 wrote to memory of 3736	5016	Unicorn-26304.exe	103
PID 2192 wrote to memory of 4428	2192	Unicorn-25240.exe	104
PID 2192 wrote to memory of 4428	2192	Unicorn-25240.exe	104
PID 2192 wrote to memory of 4428	2192	Unicorn-25240.exe	104
PID 2080 wrote to memory of 2380	2080	Unicorn-55049.exe	105
PID 2080 wrote to memory of 2380	2080	Unicorn-55049.exe	105
PID 2080 wrote to memory of 2380	2080	Unicorn-55049.exe	105
PID 4156 wrote to memory of 4876	4156	Unicorn-54789.exe	106
PID 4156 wrote to memory of 4876	4156	Unicorn-54789.exe	106
PID 4156 wrote to memory of 4876	4156	Unicorn-54789.exe	106
PID 2168 wrote to memory of 2496	2168	Unicorn-47338.exe	107
PID 2168 wrote to memory of 2496	2168	Unicorn-47338.exe	107
PID 2168 wrote to memory of 2496	2168	Unicorn-47338.exe	107
PID 1416 wrote to memory of 2528	1416	Unicorn-8855.exe	108
PID 1416 wrote to memory of 2528	1416	Unicorn-8855.exe	108
PID 1416 wrote to memory of 2528	1416	Unicorn-8855.exe	108
PID 3236 wrote to memory of 2552	3236	Unicorn-50753.exe	109
PID 3236 wrote to memory of 2552	3236	Unicorn-50753.exe	109
PID 3236 wrote to memory of 2552	3236	Unicorn-50753.exe	109
PID 4044 wrote to memory of 3560	4044	Unicorn-30887.exe	110

C:\Users\Admin\AppData\Local\Temp\cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe
"C:\Users\Admin\AppData\Local\Temp\cb5eef067ce05411de1aaef3aedf04e788ffff65999244f79848a095883913ceN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54789.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54789.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54014.exe
        9⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6933.exe
        10⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        10⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65019.exe
        9⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
        9⤵
        
        PID:17024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36554.exe
        8⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47913.exe
        8⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25624.exe
        8⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
        8⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        8⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38350.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9500.exe
        8⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        8⤵
        
        PID:16856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        8⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        7⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
        7⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20757.exe
        7⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        7⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40579.exe
        8⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
        9⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
        10⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        10⤵
        
        PID:18644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        9⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        9⤵
        
        PID:16984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52406.exe
        9⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        8⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62125.exe
        8⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18671.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        8⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        8⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        8⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18070.exe
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62345.exe
        7⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44610.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8419.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
        7⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        7⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        7⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
        6⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        7⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        7⤵
        
        PID:18080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23582.exe
        6⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        6⤵
        
        PID:17212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28183.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39468.exe
        7⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34231.exe
        8⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36279.exe
        9⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1907.exe
        10⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
        10⤵
        
        PID:18424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        9⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
        9⤵
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exe
        9⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27974.exe
        8⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        8⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        8⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13993.exe
        8⤵
        
        PID:18212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
        8⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65019.exe
        8⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        8⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6009.exe
        7⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        7⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
        7⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
        6⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12644.exe
        8⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38467.exe
        7⤵
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        7⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        7⤵
        
        PID:18552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
        6⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        7⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        7⤵
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11425.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42160.exe
        6⤵
        
        PID:16960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38397.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        6⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54981.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13984.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        8⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        8⤵
        
        PID:17800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57109.exe
        7⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58957.exe
        7⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
        6⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60086.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16463.exe
        7⤵
        
        PID:17444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        6⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13668.exe
        7⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        6⤵
        
        PID:16560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29354.exe
        6⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
        7⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
        8⤵
        
        PID:17844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        7⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
        7⤵
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        6⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16081.exe
        7⤵
        
        PID:14980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        6⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        5⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        6⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        6⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
        5⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9850.exe
        5⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
        5⤵
        
        PID:18488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24929.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55846.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        7⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        8⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
        9⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33360.exe
        10⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe
        10⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
        9⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        9⤵
        
        PID:16848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
        8⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
        8⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58957.exe
        8⤵
        
        PID:17156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26196.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        9⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64020.exe
        9⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        9⤵
        
        PID:18612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
        8⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        8⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        8⤵
        
        PID:18464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        7⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        7⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
        6⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30429.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
        8⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6717.exe
        9⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        9⤵
        
        PID:17788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24731.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        8⤵
        
        PID:16508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26836.exe
        8⤵
        
        PID:18576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
        7⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6494.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3780.exe
        7⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40851.exe
        6⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        7⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        7⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61757.exe
        7⤵
        
        PID:16964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54309.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        6⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6933.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        8⤵
        
        PID:60
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56557.exe
        7⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        7⤵
        
        PID:16748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        6⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6611.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        6⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21524.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33571.exe
        7⤵
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21524.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
        6⤵
        
        PID:13440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        6⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61641.exe
        5⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37702.exe
        6⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
        6⤵
        
        PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        5⤵
        
        PID:10956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1045.exe
        5⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52397.exe
        5⤵
        
        PID:16904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58056.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17168.exe
        6⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30429.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        8⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        9⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        9⤵
        
        PID:18048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65019.exe
        8⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60467.exe
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36425.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        7⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        7⤵
        
        PID:17108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        6⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1410.exe
        7⤵
        
        PID:16956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15408.exe
        6⤵
        
        PID:12604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17947.exe
        6⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        6⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        6⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        6⤵
        
        PID:18412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
        5⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        6⤵
        
        PID:17124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        6⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3295.exe
        5⤵
        
        PID:17220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52782.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43503.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41390.exe
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        8⤵
        
        PID:17268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48022.exe
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
        7⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5493.exe
        7⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-311.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exe
        6⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        6⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
        5⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51023.exe
        6⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
        5⤵
        
        PID:11388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        5⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2683.exe
        5⤵
        
        PID:18684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        6⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39650.exe
        5⤵
        
        PID:11136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
        5⤵
        
        PID:17308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57125.exe
      4⤵
      PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
      4⤵
      PID:12124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
      4⤵
      PID:2944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47338.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25240.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51684.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14062.exe
        7⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28767.exe
        8⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
        9⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        9⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        9⤵
        
        PID:17308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        9⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45209.exe
        8⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        9⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        9⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        8⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50281.exe
        7⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        8⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        9⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        9⤵
        
        PID:17696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4341.exe
        8⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53095.exe
        8⤵
        
        PID:14836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14836 -s 472
        9⤵
        Program crash
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41528.exe
        8⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12310.exe
        8⤵
        
        PID:19196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        7⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42241.exe
        7⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        6⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56545.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        8⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        9⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        9⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        9⤵
        
        PID:18692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        8⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39909.exe
        8⤵
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44256.exe
        8⤵
        
        PID:18600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40731.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        8⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43156.exe
        7⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57932.exe
        6⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        7⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
        8⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
        8⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50515.exe
        7⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39828.exe
        7⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        7⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56432.exe
        6⤵
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
        6⤵
        
        PID:18128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6797.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        6⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34459.exe
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        9⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19915.exe
        9⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        9⤵
        
        PID:18676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
        8⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        8⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        8⤵
        
        PID:18520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
        8⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62316.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
        7⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        7⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        7⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        7⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31377.exe
        7⤵
        
        PID:17492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exe
        6⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11037.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        7⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30703.exe
        8⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63532.exe
        8⤵
        
        PID:18392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52431.exe
        7⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
        7⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        6⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49954.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55461.exe
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        6⤵
        
        PID:15024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        6⤵
        
        PID:17920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
        5⤵
        
        PID:15000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        5⤵
        
        PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16533.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5846.exe
        6⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55320.exe
        7⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        7⤵
        
        PID:15488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15488 -s 424
        8⤵
        Program crash
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        7⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        6⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
        6⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        6⤵
        
        PID:16944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20171.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
        7⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        7⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        7⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23105.exe
        6⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        6⤵
        
        PID:17912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21215.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20691.exe
        5⤵
        
        PID:17116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
        5⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38867.exe
        6⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        7⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        7⤵
        
        PID:17100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52406.exe
        7⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14674.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4259.exe
        6⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49728.exe
        5⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
        6⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        7⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33907.exe
        7⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6095.exe
        6⤵
        
        PID:17260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        5⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        6⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26032.exe
        5⤵
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        5⤵
        
        PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exe
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        6⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        6⤵
        
        PID:18564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15842.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39909.exe
        5⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe
        5⤵
        
        PID:18156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42836.exe
      4⤵
      PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1332.exe
      4⤵
      PID:11324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
      4⤵
      PID:14840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
      4⤵
      PID:18700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        8⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
        9⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15620.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        9⤵
        
        PID:18040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12425.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39909.exe
        8⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe
        8⤵
        
        PID:18164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        7⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
        7⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        7⤵
        
        PID:16936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        7⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12449.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54975.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        8⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        9⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51274.exe
        9⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        8⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49954.exe
        8⤵
        
        PID:17976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23397.exe
        7⤵
        
        PID:14284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50725.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15101.exe
        7⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        7⤵
        
        PID:18652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
        6⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
        6⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        6⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42370.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64530.exe
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29354.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        8⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46584.exe
        9⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        8⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63146.exe
        8⤵
        
        PID:17880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52887.exe
        7⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45774.exe
        7⤵
        
        PID:15624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15624 -s 468
        8⤵
        Program crash
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6801.exe
        7⤵
        
        PID:18148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5656.exe
        6⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        7⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
        6⤵
        
        PID:11360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        6⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32526.exe
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21462.exe
        6⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        8⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        8⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        7⤵
        
        PID:16968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        7⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11758.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45762.exe
        6⤵
        
        PID:18496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53641.exe
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31670.exe
        6⤵
        
        PID:14868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27798.exe
        5⤵
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        5⤵
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8523.exe
        5⤵
        
        PID:15224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        5⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        6⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        8⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        8⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe
        7⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
        7⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        7⤵
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52743.exe
        6⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30387.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        7⤵
        
        PID:17704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
        6⤵
        
        PID:10480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        6⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        6⤵
        
        PID:18404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4749.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        6⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
        7⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
        7⤵
        
        PID:18056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24731.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        6⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe
        6⤵
        
        PID:17556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6009.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        5⤵
        
        PID:18324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63211.exe
      4⤵
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30429.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56843.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
        7⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30198.exe
        7⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65019.exe
        6⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        6⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe
        5⤵
        
        PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        5⤵
        
        PID:17180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58957.exe
        5⤵
        
        PID:16976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
      4⤵
      PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        5⤵
        
        PID:18064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
      4⤵
      PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33759.exe
      4⤵
      PID:13928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
      4⤵
      PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36134.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28405.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        5⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        7⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        7⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
        7⤵
        
        PID:17008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe
        6⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31486.exe
        7⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3070.exe
        7⤵
        
        PID:18368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
        6⤵
        
        PID:12100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        6⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        6⤵
        
        PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        6⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        6⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        7⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        6⤵
        
        PID:17108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62661.exe
        6⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
        5⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45542.exe
        6⤵
        
        PID:17484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62345.exe
        5⤵
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14842.exe
        5⤵
        
        PID:17476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49350.exe
      4⤵
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40579.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        6⤵
        
        PID:14844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51975.exe
        6⤵
        
        PID:17892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62974.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        5⤵
        
        PID:16380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2683.exe
        5⤵
        
        PID:18508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
      4⤵
      PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58795.exe
        5⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        5⤵
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe
        5⤵
        
        PID:17524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23942.exe
      4⤵
      PID:8588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
      4⤵
      PID:9756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5650.exe
      4⤵
      PID:17664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65510.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34459.exe
        5⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        6⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58619.exe
        6⤵
        
        PID:17952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-242.exe
        5⤵
        
        PID:11824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10927.exe
        5⤵
        
        PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
      4⤵
      PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3696.exe
        5⤵
        
        PID:15068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        5⤵
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
      4⤵
      PID:11276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
    3⤵
    PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60356.exe
      4⤵
      PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
        5⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50473.exe
        5⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17793.exe
        5⤵
        
        PID:17740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
      4⤵
      PID:10528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
      4⤵
      PID:16740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61059.exe
      4⤵
      PID:4520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37440.exe
    3⤵
    PID:7396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45338.exe
    3⤵
    PID:7212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4515.exe
    3⤵
    PID:15588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
    3⤵
    PID:1336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        6⤵
        Executes dropped EXE
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        8⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7776 -s 692
        9⤵
        Program crash
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe
        8⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        8⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2187.exe
        8⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        7⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
        8⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        7⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        7⤵
        
        PID:16912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
        7⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13241.exe
        7⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        7⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38675.exe
        7⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
        6⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30387.exe
        7⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49326.exe
        7⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31198.exe
        7⤵
        
        PID:17456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        6⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52397.exe
        6⤵
        
        PID:16856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38190.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        8⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        8⤵
        
        PID:13252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
        8⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-311.exe
        7⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exe
        7⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24415.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
        7⤵
        
        PID:17144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exe
        7⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        7⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51326.exe
        7⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        6⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58957.exe
        6⤵
        
        PID:17352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39380.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        7⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        8⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3058.exe
        8⤵
        
        PID:18204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
        7⤵
        
        PID:17040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3740.exe
        6⤵
        
        PID:11428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47361.exe
        6⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47870.exe
        6⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4051.exe
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        5⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        5⤵
        
        PID:14872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12020.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19510.exe
        6⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        8⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6820 -s 636
        9⤵
        Program crash
        
        PID:3012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5560 -s 540
        8⤵
        Program crash
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
        8⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        8⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        7⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45762.exe
        7⤵
        
        PID:18476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33812.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
        7⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55404.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        7⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31911.exe
        7⤵
        
        PID:17432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        6⤵
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
        5⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45516.exe
        6⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13984.exe
        8⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63946.exe
        8⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        7⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        7⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
        7⤵
        
        PID:16924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
        6⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45190.exe
        7⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        6⤵
        
        PID:17164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13993.exe
        6⤵
        
        PID:18176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
        6⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2717.exe
        7⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60388.exe
        7⤵
        
        PID:19328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24815.exe
        6⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57796.exe
        6⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42146.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        5⤵
        
        PID:19236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25084.exe
        5⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56545.exe
        6⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1410.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        7⤵
        
        PID:14764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        7⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
        6⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6717.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        7⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44626.exe
        6⤵
        
        PID:14000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        6⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        6⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18208.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        6⤵
        
        PID:16948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
        5⤵
        
        PID:8672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18788.exe
        5⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe
        5⤵
        
        PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
      4⤵
      PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        5⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55404.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        6⤵
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-569.exe
        5⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36425.exe
        5⤵
        
        PID:10524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        5⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31377.exe
        5⤵
        
        PID:17500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
      4⤵
      PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40675.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
        5⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
        5⤵
        
        PID:17688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
      4⤵
      PID:8904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
      4⤵
      PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
      4⤵
      PID:7088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30887.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55846.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58056.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exe
        7⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        7⤵
        
        PID:19308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19911.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        6⤵
        
        PID:14072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        6⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45506.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25330.exe
        6⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23924.exe
        7⤵
        
        PID:18348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        6⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52782.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        5⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7912.exe
        6⤵
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44962.exe
        5⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14649.exe
        5⤵
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        5⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
        6⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46861.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27101.exe
        8⤵
        
        PID:17656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        7⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
        7⤵
        
        PID:16952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        6⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
        7⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
        7⤵
        
        PID:18012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe
        6⤵
        
        PID:13240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        6⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        5⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34760.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64250.exe
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        5⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49954.exe
        5⤵
        
        PID:18004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51371.exe
      4⤵
      PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25144.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        6⤵
        
        PID:19188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
        5⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        5⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
      4⤵
      PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58369.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        5⤵
        
        PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
      4⤵
      PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
      4⤵
      PID:15620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
      4⤵
      PID:18456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49716.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28183.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        5⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30429.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe
        7⤵
        
        PID:18112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        6⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27115.exe
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        6⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        6⤵
        
        PID:15100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        6⤵
        
        PID:17816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        5⤵
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        5⤵
        
        PID:18336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-281.exe
      4⤵
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40579.exe
        5⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
        6⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
        7⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34760.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12647.exe
        6⤵
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        6⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49427.exe
        6⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        5⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        5⤵
        
        PID:13108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        5⤵
        
        PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44545.exe
      4⤵
      PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
        5⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32242.exe
        5⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        5⤵
        
        PID:17716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54309.exe
      4⤵
      PID:8364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26726.exe
      4⤵
      PID:16260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
      4⤵
      PID:17752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57791.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2783.exe
      4⤵
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
        5⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
        6⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
        7⤵
        
        PID:17748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        6⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        6⤵
        
        PID:18532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33263.exe
        5⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
      4⤵
      PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63017.exe
        5⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29119.exe
        6⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44389.exe
        5⤵
        
        PID:15076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        5⤵
        
        PID:18136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
      4⤵
      PID:10768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
      4⤵
      PID:15640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
      4⤵
      PID:17764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3811.exe
    3⤵
    PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41714.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65107.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43060.exe
        5⤵
        
        PID:14232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16593.exe
      4⤵
      PID:10928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
      4⤵
      PID:15496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
      4⤵
      PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64314.exe
    3⤵
    PID:6692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
    3⤵
    PID:12048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
    3⤵
    PID:4920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26304.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26304.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        7⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        8⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
        8⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58619.exe
        8⤵
        
        PID:18028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
        7⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-891.exe
        8⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        8⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5992.exe
        7⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14451.exe
        7⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6851.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45774.exe
        6⤵
        
        PID:15708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41714.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
        7⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        7⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63974.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        6⤵
        
        PID:16724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47822.exe
        6⤵
        
        PID:17672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        5⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
        5⤵
        
        PID:13904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        5⤵
        
        PID:17436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        5⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13375.exe
        6⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
        5⤵
        
        PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        5⤵
        
        PID:16928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exe
        5⤵
        
        PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34459.exe
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        6⤵
        
        PID:9364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        6⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8706.exe
        6⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38130.exe
        5⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        5⤵
        
        PID:15632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe
        5⤵
        
        PID:18104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
      4⤵
      PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        5⤵
        
        PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-802.exe
      4⤵
      PID:11368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
      4⤵
      PID:612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15073.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6146.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        5⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        6⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63017.exe
        7⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        7⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        7⤵
        
        PID:18184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        6⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58619.exe
        6⤵
        
        PID:17964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        5⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe
        5⤵
        
        PID:12076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        5⤵
        
        PID:16888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52581.exe
      4⤵
      PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60188.exe
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        6⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55404.exe
        6⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        6⤵
        
        PID:17116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        6⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48167.exe
        5⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        5⤵
        
        PID:13768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        5⤵
        
        PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
      4⤵
      PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
        5⤵
        
        PID:15008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        5⤵
        
        PID:18588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
      4⤵
      PID:10896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
      4⤵
      PID:15528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
      4⤵
      PID:1460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56097.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19931.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        6⤵
        
        PID:17204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exe
        5⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42421.exe
        5⤵
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54341.exe
      4⤵
      PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13984.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        5⤵
        
        PID:13452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        5⤵
        
        PID:17676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
      4⤵
      PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
      4⤵
      PID:15120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
      4⤵
      PID:17728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
    3⤵
    PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
      4⤵
      PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7858.exe
        5⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exe
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe
      4⤵
      PID:7872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
      4⤵
      PID:13720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38549.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
    3⤵
    PID:7416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29966.exe
      4⤵
      PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
    3⤵
    PID:10904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
    3⤵
    PID:15520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6234.exe
    3⤵
    PID:17776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58056.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        5⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        6⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        7⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        7⤵
        
        PID:17808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        6⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
        5⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9912.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        5⤵
        
        PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
        5⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16863.exe
        5⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        5⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59917.exe
      4⤵
      PID:8248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57114.exe
      4⤵
      PID:13280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20884.exe
      4⤵
      PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
    3⤵
    PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
      4⤵
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
        5⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15620.exe
        6⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
        6⤵
        
        PID:18088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27374.exe
        5⤵
        
        PID:17056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
      4⤵
      PID:8216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
      4⤵
      PID:11780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
      4⤵
      PID:16920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
      4⤵
      PID:6580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
    3⤵
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
      4⤵
      PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25318.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
        5⤵
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
      4⤵
      PID:11268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
      4⤵
      PID:18384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
    3⤵
    PID:7424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
    3⤵
    PID:10888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18110.exe
    3⤵
    PID:15552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52529.exe
    3⤵
    PID:18444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
      4⤵
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1960.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7326.exe
        6⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44960.exe
        6⤵
        
        PID:16872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        6⤵
        
        PID:17420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36887.exe
        5⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
        5⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49954.exe
        5⤵
        
        PID:18020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25073.exe
      4⤵
      PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53065.exe
        5⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
        5⤵
        
        PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32502.exe
      4⤵
      PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
        5⤵
        
        PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45774.exe
      4⤵
      PID:15716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58957.exe
      4⤵
      PID:4464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exe
    3⤵
    PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30429.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        5⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17795.exe
        6⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        5⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        5⤵
        
        PID:17168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23566.exe
      4⤵
      PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
      4⤵
      PID:14004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
      4⤵
      PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40851.exe
    3⤵
    PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9912.exe
      4⤵
      PID:12712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25676.exe
      4⤵
      PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
    3⤵
    PID:10924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14315.exe
    3⤵
    PID:15836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23775.exe
    3⤵
    PID:17472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23126.exe
    3⤵
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe
      4⤵
      PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51966.exe
        5⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
        5⤵
        
        PID:18192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
      4⤵
      PID:11628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42241.exe
      4⤵
      PID:16488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
      4⤵
      PID:18664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51554.exe
    3⤵
    PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5774.exe
      4⤵
      PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exe
      4⤵
      PID:12596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exe
      4⤵
      PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63241.exe
    3⤵
    PID:9428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
    3⤵
    PID:13344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6972.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24130.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24130.exe
  2⤵
  PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56002.exe
    3⤵
    PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
      4⤵
      PID:15312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58754.exe
      4⤵
      PID:18712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
    3⤵
    PID:11376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
    3⤵
    PID:16352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
    3⤵
    PID:18544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59848.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59848.exe
  2⤵
  PID:7152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
  2⤵
  PID:10676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe
  2⤵
  PID:15288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
  2⤵
  PID:7124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6820 -ip 6820
1⤵
PID:8380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5560 -ip 5560
1⤵
PID:9132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 7776 -ip 7776
1⤵
PID:13504

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe

Filesize
468KB

MD5
2e2dba326194452420d291d3350d4b6e

SHA1
8be6cad06a9ba98b9bf141bf684945bd023c46a2

SHA256
dfe6a1d3a8b29d5283484e73ee9063015ccf1ed9e039a2366e3ea373dbadfa62

SHA512
7f68062490150c5ea23306921dfaae0e705df80b360ac7d8c9150cde66893e725dbe27265eb80b0ef9a82d0af426ca3f4db884c450e7e88114b0c92dbb8fb631

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15073.exe

Filesize
468KB

MD5
53310b7c4ff6df3c04a44902f59e4556

SHA1
8011886c27770a631e3476be805e2cf215aa2e0b

SHA256
b6330b141dab6a622e5ed0eba595694597b3ffdcf6f5c238ab46bdc9f6712ccd

SHA512
01054d81e05ac46c221e34331cca3cbb71b54da6f54263d7c92ac8ff543dafc52a61615dc3b1d87e7e0d3521895597fdb38d3204278a3a66e563049712c3545a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16533.exe

Filesize
468KB

MD5
e5c0cf322c1597a19b3393698301a3a2

SHA1
1df4f0b2b52ee994b0dc8c08882b21ebee093e97

SHA256
7c55f97d0f77cf05b20895b5ddd2c41e36eee7cc14d30392d325138b14c8e3ff

SHA512
d06431775322e691a9e621fc9761eed15a7a9656467ef8f33e43e14763148eb37be3b873746494ef350deeb1940513c6028cff2c0223892708b15c6efb899074

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe

Filesize
468KB

MD5
12d52ce9676e894c482d745f130a4516

SHA1
3828ee68edb5e1b170590958d62c6eb1bc7f4468

SHA256
7e5bd974fa7f88444f34219fc6471434bb41b3f31d84e0efe439a8f4742ed9e4

SHA512
9f1b2b758fca43aeb8bdd5adc9b98948e7f0ca0c784444208c1da3e806ec94f12c1e61e1865e0844395103a42b7dacb97ab8501ead72f811f239c9c00d3ff05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exe

Filesize
468KB

MD5
11360f38d670eb23d7fa4ca21671c7cb

SHA1
0bfc9a7e213e6e2683d115d4626f239ddb544642

SHA256
8369d660d22f5b21f7e8771273ea0cd07c07712bf4036b1820610b97e484db69

SHA512
5c7d289222df4cb2c74ebad60b43d20e5d772c29fe63e9f8793b2c8521f8f2548eb25a02c5b95924b4c910b8c614b1de37a22a8120fcafb41b0362201ca356d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe

Filesize
468KB

MD5
1a666537a236f6b6648675c1b6707375

SHA1
e6fa55264d95463ae3883abada494499a1226a0b

SHA256
c628ef36385261e4c468d5b1f0f81df00135f31408720945a9cb0fa0415a1ee8

SHA512
d049b0398cef4c515caa091b7ebb44d834f945cb41121bd870f92b1cb9ee5ba05016d50a55ce16159850220504cdc4dca680349aea37f2b6228af6cac8ceef22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24929.exe

Filesize
468KB

MD5
afa66b40bd5beb512ab1013c4303e6a3

SHA1
bf87f5a586d2e4c66cc763df679d023d6a238e88

SHA256
74a41946007b0a5902d1b40f27662a5eb21c7fbdd0683532e060a5eee168bf7a

SHA512
5669c851afa05f2add83b110573897cb6f53af81185ad709c7ea0f9dd718e4ec4432c08cd7b307a6d468562393a5e05cb5e6467cd7d944df5d83de60b1247f0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25240.exe

Filesize
468KB

MD5
f3045201f30d18db0543b897d9e24129

SHA1
c54bd8fb6e02a6f721f48d2804e4570fc5a25fcb

SHA256
7b25b154da3ed126b73d624e38da85af2d24acf5e093b3a37dda0ede9c006ac9

SHA512
feba825de7e903d5ea6b26b218e3a544d80cfe9ce9fc10274c9fad946802d819b9d47a488fd07e5c2184c59305e30bd9e8dd3798c5a53e6eaf7dcc678972b5eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26304.exe

Filesize
468KB

MD5
6d69c9883f1e20789a483b7a7e3a5c3c

SHA1
dc22252a20d977286cce3a0e675c22abada959a0

SHA256
e13f4e63ffa791e8b8c34e663ca2314457585f71090e2990db768d7a3852e952

SHA512
cdde8dd176451e4058c171e6473ad849dae49348a39b8b16ecf12c4edddba35be07b0dee1bbaaf147fecc3a0c3c50d24db49dafd86182fe7eff7fb655f383edb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30887.exe

Filesize
468KB

MD5
612060d0102d74a866c5b8670997a0ff

SHA1
62137a90a81a16cdd8048d59f6b5acc5c8ba6ffe

SHA256
39b33fb07016f9a197c2390ae6ca069664f529ecf478fe2f8875aab69a87898c

SHA512
94e23287f918dd1b3b689296e04387b8c27294b3487830ad1029ba1561d7fa127340241349fe47c783ba267862fac65c6a5e877a9d8933b5e8fbf7e39317746c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe

Filesize
468KB

MD5
7ce410b0fa84715f24905feaa9db748d

SHA1
dec74d6678925c31193c50426a4dfee3ab3d1b5e

SHA256
efb8895660641ce7a3d030057c7d6832a94720656a809774373b69382457dc00

SHA512
d097fb26031eaacc89b8e595fa05557faf1c94b9c08d58006f7e5ad539748a40656b6ef1afbd7e47cc6db0cf65343c66789c9af020ce4e7a849d189cdcdf9895

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36134.exe

Filesize
468KB

MD5
8b164b6a1a4bbdccd26a3fff36ac2c39

SHA1
208d60c17ff76aac945e706b97d3e609288b963c

SHA256
ae7dd93c1c64cad5d6f1fe1363e4cbbc7588207974699ae449e0a537f22a1500

SHA512
bb1f092ded1d64153467926b2b85d19054f1e05b2e0f70aa41b9211f00b19918b0ae036c4131df9188115a4bb43bcd7f904c110b61ecc00d80127e1520e08123

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe

Filesize
468KB

MD5
46b0648d81c32db30d2ae37979684e80

SHA1
273fcbe2f355d53b2074eda911863bbc774b272f

SHA256
af4cb799e033527929dd1f3a1cf02c1abaaac0ece633a243feaadcac55620484

SHA512
0a804ea15906403f22367d098b53b49b67fa676883650d02864f318fce412e96320a9c2660ac67b31f5bbbc0a17b71166989da8edd283e1d613e4bef4fc44f25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe

Filesize
468KB

MD5
5ebbdb1611d9c928e5f24754c48bdb04

SHA1
e21c40a0ea02b9d137f513dc51bb9744c3b5f52c

SHA256
3a6b4dd1da21348e4e45ccd3a82ec3943066d512c089a4fdb1b7327afacd1641

SHA512
1640445bad793ccf5543dbd0600374a06e4461d55584c9b6a8e7ca138f143ea503ae39597a97c41038743d2f2f85f8bd265b969bc000ee242603d4c6130e10cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47338.exe

Filesize
468KB

MD5
ff92ae70d104405ad27aa4ab458809ad

SHA1
4a14c5512a61eebe4cce08796db5a1eb2b92cf9b

SHA256
17b431979c5010c8e260fc9a0afc6f3190d4fb2102610a0df491f35c6b253cb7

SHA512
dd42fbb5c8825e31ffb39700264e751fbb22fac50cabe89685c96d49f041f2898b01632bbdc26884bbd1fc2a1f25b101cc534c340b999014b3191da52eb00b1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe

Filesize
468KB

MD5
0d8933e331b71cb45404d957648879eb

SHA1
b8a0c2a5354776392993233cb4dc692821ecab0a

SHA256
0518da5e42f564615b12faefbcf7af5a655d24ff909d804096245ffbabed35fa

SHA512
651ff21dd4321bbf533302605c7053c9aae81a465c66217dd5a406849a5564ab1061fdeb50f036d8aed30bec1ab2385a5cc3feb7f7894f60418cab061fb994db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49716.exe

Filesize
468KB

MD5
2419c0170a239b81858f46070b4bcc75

SHA1
8901f7684563b48d819eeee2299ced1617962245

SHA256
73ba9c2bc8fcfbdf437a470db8227fde95d4892a1a30b23de5e6638baca6720b

SHA512
a83e1c352f7ad17155e3e16956e158213159fd174073244cfc62a0013a52a6053e2fdb6f2c148093e929f61002ea0f272838212b481a14bea881a6533a89bd1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe

Filesize
468KB

MD5
f7b99f713cc2b05cddb4225690a82e1e

SHA1
6fe4e46e58973537f2ccab848d6c990d05d22158

SHA256
45713ccc7c218572fe1c578969bb53a2116718ee99c60f17640a637ee5872418

SHA512
4df7ebec00ba207d2782b8b95e091f48d073186703f115d733a7329f2d33907d323bc8b6bc849ef6ac765badf0afeb6e95c3d0f0c180fd939ce15e7fc5890199

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe

Filesize
468KB

MD5
81dd206b231dbf6bc2a50ccdc181b9b8

SHA1
1b4dbe52706779eb614a5b2eac9190eeb5a08ade

SHA256
2a9cce593ae63e8eeb20887047e20fed002b505489776f152feb6866ae691381

SHA512
ada98683d57ddd4b12eafeaf2fc3505c58250942e020b0c9aa9761729cdbe5dd66896f379bafec938bf26580aaa58273a39b37612b973fdb1f49f53bba0c93de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe

Filesize
468KB

MD5
9b1682dacc323ff56b030f24d5e71b0e

SHA1
3b08b687bdfbc4d1f26296b5ac4a3a85ecfe9fca

SHA256
fb44a0568b38cc6d07793399caa2e54572891de179ee692817503f5032479034

SHA512
7607a4409296e6a084b74160138533a5dc84b12a1521e6896b7a420f5949fa6c4e02bc3921be65c2c9734861e7edbd416db9c3934cc867adac710c688ca11b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe

Filesize
468KB

MD5
98db90c7278298fdfa886f91adc7efec

SHA1
f897d867ee3bf09b4fc90c4a3654b18f362a0c2f

SHA256
88ea38a6cd77f05febf9dd0a1750e7783a90266a96befd0085d08da166c97bff

SHA512
ec0a4741560900e21b6d22f6f8eaf7a13a54012b0af796f6550a68fe16f068da78c4d6c2388a11f3621e43ae7cce48f861eace382e19419af3415c0ba31a285e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51684.exe

Filesize
468KB

MD5
74b12fd4f2d3a16ce50cae41365592d7

SHA1
c9cd90402aa07b4e71bd37a6c84ee87c03d1c9ab

SHA256
7e3e97b454f7f9b0e2b30a3184d35a42e7ceb310578af0373aabb82ffa3c24c0

SHA512
32f5a6966c3b1bce0ecd21c1c32b6dc74a44cbc4946c7f5c0bf3017faf951b2c1203d89cf9f3a4f93b0220ea66e9ee0634be1715ac7d3e1e82c223f09d14fda1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe

Filesize
468KB

MD5
e0e61261d95e4d1ff4e41e7cd3a57000

SHA1
24ac516b3de9b79de23d9ac2d8cf80ed1fd61716

SHA256
75cbaa8aeda63bd307b6d30d72b2be79d02e079cd4da921061406424cf90ca56

SHA512
fd4dae3e90e082ac33fe0ddb9df14d4c0c994795ad5a79b7ee082beb78e0b70e6f0c95fbe986e80cf7b34da20292d63e54cbf97c3150c8db0473da5b54db1464

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe

Filesize
468KB

MD5
43c2fc4ce57207ca2626f5071491cc9b

SHA1
4924d952c52937bede08fbeb9af1b81dd6ca85be

SHA256
c1dcceb5d71966267c85d61cd24d29e8339da1aaa3e2826032856558c9c4cb02

SHA512
8ad06e846be48d125d5a31e6f32c5f60e59ca594e5422b0bc2cbcdd0e1c455943c3ad5c8191e9aed4b100e5a6a1327c031063e926bf6f82bc8e0fd602eece63b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54789.exe

Filesize
468KB

MD5
7bc19302ee918f23129583c4113d2c17

SHA1
a632c1ca2ffd113ebbabfd7ec53f6f6a4294ff14

SHA256
ce9744d7d4f03e9b70f6f22d038f144a1847e63c4ff7c93729e75788f3c09a9d

SHA512
51486ac082b3149f30a7dde9f1b3e1fb27b1f336765ec9263492c48b79e5cdf439cfbb067efd80ea37d01fcf927e0d386540637e612586a9cb69a3d0306c0467

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe

Filesize
468KB

MD5
8f88fa26c6ac685aa15f50c9e6062119

SHA1
218388b18e80b13031dbb61ef73681bd70dbd058

SHA256
d231712b6f56c1c3f0706d3f8d73ea4b492afdd8f1c3f7817bee6eafa99b2628

SHA512
23be9d877fa1ce1c55bc2a461971a90c19b7cb9bfaea33a7e8a707e61a16b94ad095d6c3f9701f08bd3888ff6034ba216af457e2e33cf1b9ed19d0a5ca0d1821

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55320.exe

Filesize
468KB

MD5
a2e96de4ffa9b4ab1c934b2323f07f99

SHA1
6460ef505a81d537aff81459774212f996a9bc10

SHA256
458ded675931881c18d82afb5303aced4563bf2de180b958f3e7933dc6ad444b

SHA512
92e27de2ef2302602bd41ba4cdc2fdf422d77e38de0fbd85de4dbc0d762aff8e97f8fb769869f75096cbd59e3dfc22622225f9eff5ae6fa5c8b95e4b56abd97c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55846.exe

Filesize
468KB

MD5
1021556948222cc896f88ea512955607

SHA1
fa5b68a38ddee2731eb3ab1361b22a6c5951a5b6

SHA256
69a0a7c1da216dd2f03ba1bdab04eb1f987999409658a526c6989a6f4b6b0333

SHA512
8284675a7990b0f3d4d0353e2adef8dda2ade9502cd4f096dc43783d616e573a9cfb0549851e32cc4b9c1636dbd49c1f80752cdc60862ced3b313625bfdc96e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe

Filesize
468KB

MD5
b5561ebc4138eb59f84120274629cf4a

SHA1
bd977c917757206f72fdf2da760acd1aef12a55b

SHA256
b910f30c260c35e622a1eadacd9e61aed729f5f64bc0bdc29e854d49d10cff49

SHA512
0be89bfef4db59983697520f7ec32d1d3e7fee248e9bf49de1f30ef8b4e70a95e8fd99b772fdb3dd25db608cbaecaf35d21f2ff2f2b97a04e34c8bb0b41a6b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe

Filesize
468KB

MD5
7cb21efe96adbb68476a2aca2d983cd4

SHA1
3033c5db84bae0ee880981e8bbbf1c43bb7f146a

SHA256
68d060b6db431ad62665820f024a042fbd8aa54c046d08ef43d0ca98e17148d6

SHA512
21bf8164c0783b3240b70dfc5e253bb7904bc20e8183dff482b05ec7cfb214332f95fe4567a150d6ae35749750728eb7cd0ed213d948c24a8403cfbc89c4e254

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe

Filesize
468KB

MD5
027e69ca6f9aeb2faf935bc20d92a342

SHA1
36d6209a9e66e251beb83ff10e4409de7d54b766

SHA256
ab7a2d13d191ec9b69046765bd8775e9fe09e2a7e5fb51a95376352cc187a40d

SHA512
ea89df4edf180bceccbb03b86a3506d17b69ffb9802bb086d9d6874e15c5380267223d98ceea1b0aa7ca97086e3f21cf464fe54ef152b67e140eb7bb68015747

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads