021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe
Size

468KB
MD5

a03fd9d0a6d14bfb67ea013ae7a95eef
SHA1

fdd1ed48f63445c30e53ed9cce656e5ef7c3baf4
SHA256

021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57
SHA512

21e631720664c3d382967d546ef272572af2069c1c50dd8cefd2537cf8d6b6328073c1c1c5eac6beb5aabba622afd3b05cf62a19ec8ef8701963a98ea824814d
SSDEEP

3072:1bB2ogIdF55UtbYbHzcjVf8/EIhCE7/B8LH0xVP7E792MxWueVeP:1bcodPUtEH4jVfmjd/E7MwWue

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1440	Unicorn-58241.exe
1544	Unicorn-14816.exe
4464	Unicorn-52320.exe
3672	Unicorn-25481.exe
3368	Unicorn-17313.exe
4268	Unicorn-62984.exe
4900	Unicorn-3014.exe
2888	Unicorn-26854.exe
1488	Unicorn-32985.exe
4876	Unicorn-32985.exe
1180	Unicorn-32985.exe
1464	Unicorn-16383.exe
1604	Unicorn-62320.exe
3240	Unicorn-4654.exe
1800	Unicorn-10400.exe
4676	Unicorn-2232.exe
1168	Unicorn-2232.exe
452	Unicorn-2232.exe
1476	Unicorn-2232.exe
4940	Unicorn-2232.exe
3204	Unicorn-39735.exe
316	Unicorn-42503.exe
1792	Unicorn-31567.exe
1312	Unicorn-43000.exe
4040	Unicorn-37135.exe
4444	Unicorn-54121.exe
4976	Unicorn-45688.exe
1008	Unicorn-43523.exe
668	Unicorn-46109.exe
4252	Unicorn-29773.exe
4280	Unicorn-9907.exe
1472	Unicorn-21605.exe
4720	Unicorn-5268.exe
2416	Unicorn-5268.exe
1932	Unicorn-42217.exe
2148	Unicorn-38133.exe
3196	Unicorn-12667.exe
2988	Unicorn-18267.exe
216	Unicorn-29202.exe
3668	Unicorn-25616.exe
1628	Unicorn-25881.exe
4392	Unicorn-18481.exe
1112	Unicorn-64152.exe
4980	Unicorn-61551.exe
4924	Unicorn-47816.exe
3756	Unicorn-39647.exe
2360	Unicorn-41131.exe
3440	Unicorn-59513.exe
4560	Unicorn-39477.exe
3040	Unicorn-35393.exe
1872	Unicorn-7359.exe
644	Unicorn-18294.exe
2776	Unicorn-15933.exe
1468	Unicorn-3415.exe
1264	Unicorn-19825.exe
2936	Unicorn-57328.exe
924	Unicorn-24655.exe
3948	Unicorn-63855.exe
2924	Unicorn-37313.exe
1432	Unicorn-20977.exe
2716	Unicorn-49736.exe
4612	Unicorn-58096.exe
3852	Unicorn-12424.exe
1620	Unicorn-28953.exe

Program crash 13 IoCs

pid	pid_target	Process	procid_target
11000	9840	WerFault.exe	433
12556	10060	WerFault.exe	453
12552	10052	WerFault.exe	452
11576	10072	WerFault.exe	454
14028	10072	WerFault.exe	454
15588	9840	WerFault.exe	433
15980	10052	WerFault.exe	452
15992	10060	WerFault.exe	453
15012	6788	WerFault.exe	275
4376	12652	WerFault.exe	768
16064	18536	Process not Found	1142
20576	18528	Process not Found	1141
13596	5652	Process not Found	985

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47100.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6784	Process not Found
Token: SeChangeNotifyPrivilege	6784	Process not Found
Token: 33	6784	Process not Found
Token: SeIncBasePriorityPrivilege	6784	Process not Found
Token: SeCreateGlobalPrivilege	19704	Process not Found
Token: SeChangeNotifyPrivilege	19704	Process not Found
Token: 33	19704	Process not Found
Token: SeIncBasePriorityPrivilege	19704	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe
1440	Unicorn-58241.exe
1544	Unicorn-14816.exe
4464	Unicorn-52320.exe
4268	Unicorn-62984.exe
3672	Unicorn-25481.exe
3368	Unicorn-17313.exe
4900	Unicorn-3014.exe
1180	Unicorn-32985.exe
1488	Unicorn-32985.exe
4876	Unicorn-32985.exe
2888	Unicorn-26854.exe
1464	Unicorn-16383.exe
1604	Unicorn-62320.exe
3240	Unicorn-4654.exe
4676	Unicorn-2232.exe
452	Unicorn-2232.exe
4940	Unicorn-2232.exe
1168	Unicorn-2232.exe
1476	Unicorn-2232.exe
1800	Unicorn-10400.exe
316	Unicorn-42503.exe
3204	Unicorn-39735.exe
1312	Unicorn-43000.exe
4040	Unicorn-37135.exe
1792	Unicorn-31567.exe
4444	Unicorn-54121.exe
4976	Unicorn-45688.exe
1008	Unicorn-43523.exe
668	Unicorn-46109.exe
1472	Unicorn-21605.exe
4252	Unicorn-29773.exe
4280	Unicorn-9907.exe
2416	Unicorn-5268.exe
1932	Unicorn-42217.exe
4720	Unicorn-5268.exe
2988	Unicorn-18267.exe
3668	Unicorn-25616.exe
3196	Unicorn-12667.exe
4392	Unicorn-18481.exe
216	Unicorn-29202.exe
1628	Unicorn-25881.exe
4980	Unicorn-61551.exe
4924	Unicorn-47816.exe
2148	Unicorn-38133.exe
3756	Unicorn-39647.exe
1112	Unicorn-64152.exe
3440	Unicorn-59513.exe
2360	Unicorn-41131.exe
4560	Unicorn-39477.exe
3040	Unicorn-35393.exe
644	Unicorn-18294.exe
1872	Unicorn-7359.exe
2776	Unicorn-15933.exe
1468	Unicorn-3415.exe
1264	Unicorn-19825.exe
2936	Unicorn-57328.exe
3948	Unicorn-63855.exe
2924	Unicorn-37313.exe
1432	Unicorn-20977.exe
2716	Unicorn-49736.exe
4612	Unicorn-58096.exe
3852	Unicorn-12424.exe
1620	Unicorn-28953.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1440	3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe	86
PID 3308 wrote to memory of 1440	3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe	86
PID 3308 wrote to memory of 1440	3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe	86
PID 1440 wrote to memory of 1544	1440	Unicorn-58241.exe	87
PID 1440 wrote to memory of 1544	1440	Unicorn-58241.exe	87
PID 1440 wrote to memory of 1544	1440	Unicorn-58241.exe	87
PID 3308 wrote to memory of 4464	3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe	88
PID 3308 wrote to memory of 4464	3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe	88
PID 3308 wrote to memory of 4464	3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe	88
PID 1544 wrote to memory of 3672	1544	Unicorn-14816.exe	89
PID 1544 wrote to memory of 3672	1544	Unicorn-14816.exe	89
PID 1544 wrote to memory of 3672	1544	Unicorn-14816.exe	89
PID 1440 wrote to memory of 4268	1440	Unicorn-58241.exe	90
PID 1440 wrote to memory of 4268	1440	Unicorn-58241.exe	90
PID 1440 wrote to memory of 4268	1440	Unicorn-58241.exe	90
PID 4464 wrote to memory of 3368	4464	Unicorn-52320.exe	91
PID 4464 wrote to memory of 3368	4464	Unicorn-52320.exe	91
PID 4464 wrote to memory of 3368	4464	Unicorn-52320.exe	91
PID 3308 wrote to memory of 4900	3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe	92
PID 3308 wrote to memory of 4900	3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe	92
PID 3308 wrote to memory of 4900	3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe	92
PID 3672 wrote to memory of 1488	3672	Unicorn-25481.exe	97
PID 3672 wrote to memory of 1488	3672	Unicorn-25481.exe	97
PID 3672 wrote to memory of 1488	3672	Unicorn-25481.exe	97
PID 3368 wrote to memory of 4876	3368	Unicorn-17313.exe	99
PID 3368 wrote to memory of 4876	3368	Unicorn-17313.exe	99
PID 3368 wrote to memory of 4876	3368	Unicorn-17313.exe	99
PID 1440 wrote to memory of 2888	1440	Unicorn-58241.exe	98
PID 1440 wrote to memory of 2888	1440	Unicorn-58241.exe	98
PID 1440 wrote to memory of 2888	1440	Unicorn-58241.exe	98
PID 4900 wrote to memory of 1180	4900	Unicorn-3014.exe	100
PID 4900 wrote to memory of 1180	4900	Unicorn-3014.exe	100
PID 4900 wrote to memory of 1180	4900	Unicorn-3014.exe	100
PID 3308 wrote to memory of 1464	3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe	101
PID 3308 wrote to memory of 1464	3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe	101
PID 3308 wrote to memory of 1464	3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe	101
PID 4464 wrote to memory of 1604	4464	Unicorn-52320.exe	102
PID 4464 wrote to memory of 1604	4464	Unicorn-52320.exe	102
PID 4464 wrote to memory of 1604	4464	Unicorn-52320.exe	102
PID 1544 wrote to memory of 3240	1544	Unicorn-14816.exe	104
PID 1544 wrote to memory of 3240	1544	Unicorn-14816.exe	104
PID 1544 wrote to memory of 3240	1544	Unicorn-14816.exe	104
PID 1180 wrote to memory of 1800	1180	Unicorn-32985.exe	105
PID 1180 wrote to memory of 1800	1180	Unicorn-32985.exe	105
PID 1180 wrote to memory of 1800	1180	Unicorn-32985.exe	105
PID 2888 wrote to memory of 1168	2888	Unicorn-26854.exe	108
PID 2888 wrote to memory of 1168	2888	Unicorn-26854.exe	108
PID 2888 wrote to memory of 1168	2888	Unicorn-26854.exe	108
PID 1464 wrote to memory of 4940	1464	Unicorn-16383.exe	110
PID 1464 wrote to memory of 4940	1464	Unicorn-16383.exe	110
PID 1464 wrote to memory of 4940	1464	Unicorn-16383.exe	110
PID 1488 wrote to memory of 4676	1488	Unicorn-32985.exe	106
PID 1488 wrote to memory of 4676	1488	Unicorn-32985.exe	106
PID 4876 wrote to memory of 1476	4876	Unicorn-32985.exe	109
PID 1488 wrote to memory of 4676	1488	Unicorn-32985.exe	106
PID 4876 wrote to memory of 1476	4876	Unicorn-32985.exe	109
PID 4876 wrote to memory of 1476	4876	Unicorn-32985.exe	109
PID 1604 wrote to memory of 452	1604	Unicorn-62320.exe	107
PID 1604 wrote to memory of 452	1604	Unicorn-62320.exe	107
PID 1604 wrote to memory of 452	1604	Unicorn-62320.exe	107
PID 4900 wrote to memory of 3204	4900	Unicorn-3014.exe	111
PID 4900 wrote to memory of 3204	4900	Unicorn-3014.exe	111
PID 4900 wrote to memory of 3204	4900	Unicorn-3014.exe	111
PID 3308 wrote to memory of 316	3308	021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe	112

C:\Users\Admin\AppData\Local\Temp\021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe
"C:\Users\Admin\AppData\Local\Temp\021436e17c06a9b9df07f2e0bd1f497636295d51cc832df8637cb5597736bd57.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58241.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58241.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14816.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25481.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12424.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35341.exe
        9⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        10⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
        11⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40725.exe
        11⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-978.exe
        10⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        10⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46329.exe
        10⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        9⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24906.exe
        9⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        9⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exe
        9⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21825.exe
        9⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44988.exe
        8⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        9⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        10⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60144.exe
        10⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19764.exe
        10⤵
        
        PID:17000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25290.exe
        9⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3683.exe
        9⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37296.exe
        9⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        8⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        8⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        7⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59573.exe
        9⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14591.exe
        9⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        9⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42011.exe
        8⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
        8⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35386.exe
        8⤵
        
        PID:17144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        8⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        8⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        8⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        8⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        8⤵
        
        PID:18064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
        7⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        7⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
        7⤵
        
        PID:17868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18267.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38081.exe
        7⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        8⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41281.exe
        9⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        9⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
        8⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        8⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        8⤵
        
        PID:17916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        8⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3491.exe
        8⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        8⤵
        
        PID:17092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
        8⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12934.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        7⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20761.exe
        7⤵
        
        PID:15040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        6⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        8⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        9⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        8⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        8⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
        8⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        8⤵
        
        PID:18268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32781.exe
        8⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20356.exe
        8⤵
        
        PID:17624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8674.exe
        7⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1867.exe
        7⤵
        
        PID:17320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21333.exe
        7⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        7⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5068.exe
        7⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        6⤵
        
        PID:16316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
        6⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43523.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41501.exe
        8⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63657.exe
        9⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        10⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56870.exe
        10⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        9⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        9⤵
        
        PID:17376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
        9⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42011.exe
        8⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        9⤵
        
        PID:17788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40963.exe
        8⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
        8⤵
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48729.exe
        8⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        8⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
        8⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65047.exe
        8⤵
        
        PID:16844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        8⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4015.exe
        7⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        7⤵
        
        PID:17544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        6⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        7⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        8⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23806.exe
        8⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
        7⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15148.exe
        7⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        6⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        6⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17447.exe
        7⤵
        
        PID:16484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25386.exe
        6⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41864.exe
        6⤵
        
        PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        8⤵
        
        PID:15620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        8⤵
        
        PID:17848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25779.exe
        7⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        7⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        7⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32832.exe
        6⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49589.exe
        7⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16667.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
        7⤵
        
        PID:17644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1214.exe
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exe
        6⤵
        
        PID:13316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32061.exe
        6⤵
        
        PID:17972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14064.exe
        6⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
        8⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        7⤵
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
        6⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10786.exe
        6⤵
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        6⤵
        
        PID:17568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58992.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15784.exe
        6⤵
        
        PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        5⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4386.exe
        5⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        5⤵
        
        PID:17772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51101.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54713.exe
        8⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11820.exe
        9⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        9⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        9⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21119.exe
        8⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        8⤵
        
        PID:12652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12652 -s 452
        9⤵
        Program crash
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50229.exe
        8⤵
        
        PID:17996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        7⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18857.exe
        8⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26922.exe
        7⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56890.exe
        7⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        7⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
        8⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        7⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16014.exe
        7⤵
        
        PID:16604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        6⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        7⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
        7⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29620.exe
        6⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19625.exe
        7⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        6⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        6⤵
        
        PID:18036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34765.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        8⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        8⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2827.exe
        8⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        8⤵
        
        PID:17632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        7⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exe
        7⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7411.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        7⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
        8⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        7⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53512.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        6⤵
        
        PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49247.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27277.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52557.exe
        7⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7470.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38353.exe
        7⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30578.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        6⤵
        
        PID:11928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        6⤵
        
        PID:16456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
        5⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49589.exe
        6⤵
        
        PID:12952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20954.exe
        5⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        5⤵
        
        PID:14644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45688.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35393.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51101.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        8⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34783.exe
        9⤵
        
        PID:17004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        9⤵
        
        PID:17832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        8⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        8⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        7⤵
        
        PID:11372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        6⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
        7⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        7⤵
        
        PID:13116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12166.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65468.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        6⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60016.exe
        5⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6664.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
        7⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        8⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
        8⤵
        
        PID:17236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11659.exe
        7⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17156.exe
        7⤵
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44316.exe
        6⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43103.exe
        7⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34644.exe
        6⤵
        
        PID:16912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        5⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exe
        6⤵
        
        PID:17508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29620.exe
        5⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        5⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exe
        5⤵
        
        PID:17700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34765.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5631.exe
        6⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16237.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56060.exe
        7⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        6⤵
        
        PID:13988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        6⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        6⤵
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        5⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
        5⤵
        
        PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14640.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
        6⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34103.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58353.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21119.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        5⤵
        
        PID:12788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        5⤵
        
        PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3692.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21333.exe
        5⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        5⤵
        
        PID:14156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44077.exe
        5⤵
        
        PID:15200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12590.exe
      4⤵
      PID:10328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exe
      4⤵
      PID:14912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44429.exe
      4⤵
      PID:17484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe
        6⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40105.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        8⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        8⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exe
        8⤵
        
        PID:17948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36355.exe
        7⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        7⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        6⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
        7⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65073.exe
        7⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40476.exe
        6⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        6⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
        5⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        7⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        7⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22137.exe
        7⤵
        
        PID:17688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14207.exe
        6⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        5⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8587.exe
        6⤵
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        6⤵
        
        PID:17840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29620.exe
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17986.exe
        5⤵
        
        PID:15004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35533.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        7⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        7⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50179.exe
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        6⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        6⤵
        
        PID:17600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        5⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exe
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        6⤵
        
        PID:18248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
        5⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31120.exe
        5⤵
        
        PID:12648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        5⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        5⤵
        
        PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23016.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55481.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42241.exe
        6⤵
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        6⤵
        
        PID:14848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53029.exe
        6⤵
        
        PID:18116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25779.exe
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        5⤵
        
        PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        5⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-601.exe
        5⤵
        
        PID:10544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
      4⤵
      PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35621.exe
      4⤵
      PID:16152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
      4⤵
      PID:16920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43000.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37313.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
        8⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
        8⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25779.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        7⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        6⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
        7⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
        7⤵
        
        PID:17276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        7⤵
        
        PID:17760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
        6⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32158.exe
        6⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14025.exe
        6⤵
        
        PID:17248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        6⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22043.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
        7⤵
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50179.exe
        6⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14207.exe
        6⤵
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62097.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        5⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32241.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        6⤵
        
        PID:14060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-217.exe
        6⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54892.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        5⤵
        
        PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        5⤵
        
        PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47401.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        6⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41451.exe
        7⤵
        
        PID:16372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50179.exe
        6⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47648.exe
        6⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12697.exe
        6⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        5⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60305.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        6⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50805.exe
        6⤵
        
        PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24906.exe
        5⤵
        
        PID:10436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18483.exe
        5⤵
        
        PID:15188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1685.exe
        5⤵
        
        PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
      4⤵
      PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        5⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
        6⤵
        
        PID:11864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34093.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        5⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24758.exe
        5⤵
        
        PID:15120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        5⤵
        
        PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
      4⤵
      PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
        5⤵
        
        PID:15328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
        5⤵
        
        PID:17804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17638.exe
      4⤵
      PID:10592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4767.exe
      4⤵
      PID:14972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4334.exe
      4⤵
      PID:5228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29202.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
      4⤵
      PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39721.exe
        6⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37633.exe
        7⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
        6⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        6⤵
        
        PID:15080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26222.exe
        6⤵
        
        PID:17612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        5⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        6⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61784.exe
        6⤵
        
        PID:17312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        6⤵
        
        PID:18028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26922.exe
        5⤵
        
        PID:14660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        5⤵
        
        PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6788
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 728
        5⤵
        Program crash
        
        PID:15012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
      4⤵
      PID:10140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
      4⤵
      PID:3404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29143.exe
    3⤵
    PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
      4⤵
      PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        5⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
        5⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65047.exe
        5⤵
        
        PID:16852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        5⤵
        
        PID:17652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
      4⤵
      PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27025.exe
        5⤵
        
        PID:556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
      4⤵
      PID:12972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12600.exe
      4⤵
      PID:14940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3500.exe
    3⤵
    PID:7864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62175.exe
    3⤵
    PID:10580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60503.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60366.exe
    3⤵
    PID:16912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20202.exe
    3⤵
    PID:6856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12018.exe
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4960.exe
        9⤵
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6029.exe
        9⤵
        
        PID:16916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
        9⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        8⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        8⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
        8⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53252.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
        7⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
        7⤵
        
        PID:17344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
        6⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        8⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
        8⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        8⤵
        
        PID:17100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
        8⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        7⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        6⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        7⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40720.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        6⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9492.exe
        6⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        7⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        8⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        9⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        8⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        8⤵
        
        PID:18004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        7⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        7⤵
        
        PID:17392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        7⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59160.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        7⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        7⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        7⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13393.exe
        7⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        7⤵
        
        PID:16816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13911.exe
        6⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        6⤵
        
        PID:17988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        5⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
        6⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        7⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        7⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        7⤵
        
        PID:18072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63687.exe
        6⤵
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        6⤵
        
        PID:18096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        5⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32899.exe
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        6⤵
        
        PID:17532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        5⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
        5⤵
        
        PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31567.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59513.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58501.exe
        6⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51192.exe
        8⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        9⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        9⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        9⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
        8⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12604.exe
        9⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43745.exe
        9⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
        8⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11536.exe
        8⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        7⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
        8⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3725.exe
        8⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63819.exe
        8⤵
        
        PID:17752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10343.exe
        6⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        7⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58416.exe
        7⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20828.exe
        7⤵
        
        PID:17012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        6⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10052 -s 440
        7⤵
        Program crash
        
        PID:12552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10052 -s 392
        7⤵
        Program crash
        
        PID:15980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        6⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        6⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34743.exe
        5⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23939.exe
        6⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12604.exe
        7⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18665.exe
        7⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52536.exe
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60555.exe
        6⤵
        
        PID:14544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        6⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60917.exe
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10699.exe
        6⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        6⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        5⤵
        
        PID:12172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        5⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        7⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21821.exe
        8⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52987.exe
        8⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        8⤵
        
        PID:17556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34279.exe
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47633.exe
        8⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19625.exe
        8⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55187.exe
        7⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        7⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
        6⤵
        
        PID:17036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        6⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40851.exe
        5⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44618.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
        5⤵
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
        5⤵
        
        PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe
      4⤵
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60696.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
        6⤵
        
        PID:17148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe
        5⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        5⤵
        
        PID:15088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53730.exe
        5⤵
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
      4⤵
      PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18431.exe
        5⤵
        
        PID:11824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
        5⤵
        
        PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50112.exe
      4⤵
      PID:9464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
      4⤵
      PID:14896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62320.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46109.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        8⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20077.exe
        9⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
        10⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23237.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64176.exe
        9⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
        9⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        9⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exe
        8⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        8⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        8⤵
        
        PID:17960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
        8⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        8⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
        7⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        7⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45341.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe
        8⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
        8⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53029.exe
        8⤵
        
        PID:17448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5307.exe
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25638.exe
        7⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
        7⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe
        7⤵
        
        PID:18212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12986.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exe
        7⤵
        
        PID:17392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        7⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38858.exe
        7⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50144.exe
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32926.exe
        6⤵
        
        PID:16408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57328.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30489.exe
        6⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        8⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        7⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        7⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11536.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        7⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32683.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37441.exe
        7⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50430.exe
        7⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38136.exe
        6⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        6⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
        7⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        7⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30439.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        6⤵
        
        PID:14280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48458.exe
        6⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        5⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        6⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
        6⤵
        
        PID:17072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        5⤵
        
        PID:14812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4334.exe
        5⤵
        
        PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9907.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        5⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58221.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        7⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        7⤵
        
        PID:17012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
        7⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        6⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exe
        5⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35381.exe
        6⤵
        
        PID:15156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        6⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
        5⤵
        
        PID:14760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
        5⤵
        
        PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48479.exe
      4⤵
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23939.exe
        5⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
        5⤵
        
        PID:9592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        5⤵
        
        PID:15292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57902.exe
        5⤵
        
        PID:14888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
      4⤵
      PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        5⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57689.exe
        6⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43511.exe
        5⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
        5⤵
        
        PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
      4⤵
      PID:14768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12066.exe
      4⤵
      PID:14448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24655.exe
      4⤵
      Executes dropped EXE
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10836.exe
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35061.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
        7⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        7⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        6⤵
        
        PID:12076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        5⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        6⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        5⤵
        
        PID:11352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53907.exe
      4⤵
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
        5⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        5⤵
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36355.exe
        5⤵
        
        PID:15048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37100.exe
      4⤵
      PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19625.exe
        5⤵
        
        PID:17380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
      4⤵
      PID:10444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exe
      4⤵
      PID:16132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13986.exe
      4⤵
      PID:16724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25616.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        5⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        6⤵
        
        PID:10680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
        6⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16256.exe
        6⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        5⤵
        
        PID:11004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        5⤵
        
        PID:11852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8031.exe
        5⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56135.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
      4⤵
      PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        5⤵
        
        PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
      4⤵
      PID:10060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10060 -s 436
        5⤵
        Program crash
        
        PID:12556
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10060 -s 392
        5⤵
        Program crash
        
        PID:15992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53512.exe
      4⤵
      PID:11580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55553.exe
      4⤵
      PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45679.exe
    3⤵
    PID:220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exe
      4⤵
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        6⤵
        
        PID:18108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        5⤵
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        5⤵
        
        PID:17496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
      4⤵
      PID:8284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
      4⤵
      PID:12280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
      4⤵
      PID:17020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24224.exe
      4⤵
      PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
    3⤵
    PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
      4⤵
      PID:9916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
      4⤵
      PID:13588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
      4⤵
      PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50457.exe
    3⤵
    PID:10292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8470.exe
    3⤵
    PID:14820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42217.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
        7⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
        7⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53029.exe
        7⤵
        
        PID:18020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8851.exe
        6⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        6⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
        5⤵
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37993.exe
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59708.exe
        7⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        7⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18437.exe
        7⤵
        
        PID:17588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26302.exe
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        6⤵
        
        PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58992.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        6⤵
        
        PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9775.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40703.exe
        5⤵
        
        PID:16300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        5⤵
        
        PID:18044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47816.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1132.exe
        5⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        6⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        7⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13393.exe
        7⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        6⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exe
        7⤵
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        7⤵
        
        PID:18080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        6⤵
        
        PID:11376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        6⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57764.exe
        5⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        6⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        5⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38136.exe
        5⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50229.exe
        5⤵
        
        PID:17936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      4⤵
      PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        6⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53865.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        7⤵
        
        PID:18088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38903.exe
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34958.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        6⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49220.exe
        5⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe
        5⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exe
        5⤵
        
        PID:17740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe
      4⤵
      PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        5⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exe
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50805.exe
        5⤵
        
        PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51264.exe
      4⤵
      PID:10320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27453.exe
      4⤵
      PID:16184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
      4⤵
      PID:15792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39735.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25881.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60577.exe
        6⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30409.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19625.exe
        8⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        7⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        7⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28806.exe
        7⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        6⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25394.exe
        6⤵
        
        PID:11556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        6⤵
        
        PID:17472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        6⤵
        
        PID:17060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        5⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46237.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        6⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61567.exe
        5⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-250.exe
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
      4⤵
      PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23939.exe
        5⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50229.exe
        6⤵
        
        PID:17520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49027.exe
        5⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
        5⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48729.exe
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43652.exe
        5⤵
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        5⤵
        
        PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
      4⤵
      PID:13240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
      4⤵
      PID:17672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61551.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25829.exe
      4⤵
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18431.exe
        7⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        7⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29338.exe
        6⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        6⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        5⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exe
        6⤵
        
        PID:17256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26922.exe
        5⤵
        
        PID:14652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7689.exe
        5⤵
        
        PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
      4⤵
      PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
        5⤵
        
        PID:11548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12957.exe
        6⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        5⤵
        
        PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
      4⤵
      PID:10072
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10072 -s 436
        5⤵
        Program crash
        
        PID:11576
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10072 -s 392
        5⤵
        Program crash
        
        PID:14028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29896.exe
      4⤵
      PID:4140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe
    3⤵
    PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
      4⤵
      PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        5⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
        6⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55613.exe
        6⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        5⤵
        
        PID:17076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
        5⤵
        
        PID:17856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26302.exe
      4⤵
      PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
      4⤵
      PID:14188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43353.exe
      4⤵
      PID:4884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
    3⤵
    PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
      4⤵
      PID:12116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63502.exe
      4⤵
      PID:16100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
    3⤵
    PID:8360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38169.exe
    3⤵
    PID:14700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18481.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25829.exe
        5⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        7⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        7⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        7⤵
        
        PID:16932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        7⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7367.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28466.exe
        6⤵
        
        PID:12784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
        6⤵
        
        PID:17928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11834.exe
        5⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
        5⤵
        
        PID:10556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31006.exe
        5⤵
        
        PID:14800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        6⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        6⤵
        
        PID:15424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        6⤵
        
        PID:17884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        5⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32992.exe
        6⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        5⤵
        
        PID:11976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54587.exe
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38209.exe
        5⤵
        
        PID:14632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62868.exe
      4⤵
      PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37638.exe
      4⤵
      PID:14724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
      4⤵
      PID:17876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
      4⤵
      PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
        5⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
        6⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        6⤵
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        5⤵
        
        PID:9840
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9840 -s 464
        6⤵
        Program crash
        
        PID:11000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9840 -s 412
        6⤵
        Program crash
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13055.exe
        5⤵
        
        PID:12064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53825.exe
        5⤵
        
        PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
      4⤵
      PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        5⤵
        
        PID:8536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exe
        5⤵
        
        PID:11340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        5⤵
        
        PID:17068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
      4⤵
      PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61567.exe
      4⤵
      PID:12864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47237.exe
      4⤵
      PID:680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48479.exe
    3⤵
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
      4⤵
      PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe
        6⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        6⤵
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        5⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        5⤵
        
        PID:11616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
        5⤵
        
        PID:17796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
      4⤵
      PID:8820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33562.exe
      4⤵
      PID:12324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26756.exe
      4⤵
      PID:16404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
    3⤵
    PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe
      4⤵
      PID:11868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-601.exe
      4⤵
      PID:16144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5194.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
    3⤵
    PID:14228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
    3⤵
    PID:18124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42503.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42503.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20977.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47977.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26893.exe
        6⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46095.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        6⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        5⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48209.exe
        6⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        6⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12270.exe
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34052.exe
        5⤵
        
        PID:15148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        5⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43013.exe
        5⤵
        
        PID:18236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15859.exe
      4⤵
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
        5⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4960.exe
        6⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2521.exe
        6⤵
        
        PID:13988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        6⤵
        
        PID:18256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19042.exe
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        5⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12697.exe
        5⤵
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38827.exe
      4⤵
      PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
        5⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23709.exe
        5⤵
        
        PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30772.exe
      4⤵
      PID:10420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21302.exe
      4⤵
      PID:14980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37396.exe
      4⤵
      PID:17460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30757.exe
        7⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        7⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53029.exe
        7⤵
        
        PID:18012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54420.exe
        6⤵
        
        PID:12912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        5⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32926.exe
        5⤵
        
        PID:16420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        5⤵
        
        PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
      4⤵
      PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        5⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        5⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42593.exe
        5⤵
        
        PID:9840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
      4⤵
      PID:9608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26922.exe
      4⤵
      PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
      4⤵
      PID:5632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1354.exe
    3⤵
    PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
      4⤵
      PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18209.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exe
        5⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20356.exe
        5⤵
        
        PID:17660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
      4⤵
      PID:12088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37972.exe
      4⤵
      PID:17896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
    3⤵
    PID:7424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
    3⤵
    PID:10356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
    3⤵
    PID:15044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
    3⤵
    PID:5620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
    3⤵
    PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
      4⤵
      PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12100.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        6⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        6⤵
        
        PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64176.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
        5⤵
        
        PID:14888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        5⤵
        
        PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11451.exe
      4⤵
      PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
        5⤵
        
        PID:14316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
      4⤵
      PID:14076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1396.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
    3⤵
    PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4405.exe
      4⤵
      PID:1924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43408.exe
    3⤵
    PID:10548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29470.exe
    3⤵
    PID:14840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe
    3⤵
    PID:15604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29763.exe
    3⤵
    PID:6800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21704.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21704.exe
  2⤵
  PID:1184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
    3⤵
    PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
      4⤵
      PID:8196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59708.exe
      4⤵
      PID:12188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
      4⤵
      PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
    3⤵
    PID:8280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57247.exe
    3⤵
    PID:13104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
    3⤵
    PID:4916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
  2⤵
  PID:6228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
  2⤵
  PID:9436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
  2⤵
  PID:14924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47694.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47694.exe
  2⤵
  PID:18056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9840 -ip 9840
1⤵
PID:10720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 10072 -ip 10072
1⤵
PID:10700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 10060 -ip 10060
1⤵
PID:11584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 10052 -ip 10052
1⤵
PID:11792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 9840 -ip 9840
1⤵
PID:13524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 10072 -ip 10072
1⤵
PID:13316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 10052 -ip 10052
1⤵
PID:15308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 10060 -ip 10060
1⤵
PID:15820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 13988 -ip 13988
1⤵
PID:16812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 12652 -ip 12652
1⤵
PID:12240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe

Filesize
468KB

MD5
39ec213f3b44443673ce4988445c741f

SHA1
ffaa57cc5886585fa1c61d644e18cf845724fb74

SHA256
9b10305564e2b4d90c01cd7fb84d9e3be5ba62c8caaec7937dbc71ad8b8c1665

SHA512
cd534df9fa8c8a68a35edb45a9a453a5ea29e179a4ad1d7083f73d7356141132aaa72b6ff7dc3e49887eb991587af7a34d927c67c1a69424502d202e2b0b73e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14816.exe

Filesize
468KB

MD5
cb17f2df019e3ea758fda081aedf5fed

SHA1
554a1c6f6c89986d20dbba4dc646d61a865ad960

SHA256
6c7dd03af838e0439e5e88f01b80449f9f17ac3e8fbb54db3b7c9bc1c25c6080

SHA512
bb42b736b08cd032c0f246a58cf651dec72400839e3d60adf5d781dbea48144c9f4f31e1570df9c07cf512724c55d6a279553e583b10fba85aad8b0a1228f6e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe

Filesize
468KB

MD5
58848114b58372818758c6df0b0484b1

SHA1
9a8d7983cf98770b770021849372ed624c35617d

SHA256
b16e40922b024256dcd835d9e8939e9eb3024d786364f4652c71947e97f16530

SHA512
72f4237037e611048670e8a0318e39898d3aab1ac52f66303e545857e89dd3c2cbef79168beb213de3de0a80be1c8a2ec08fd242c594e1056ecc0d47f1ff3c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe

Filesize
468KB

MD5
d7bdc6736c1afa18881310cc2a66c0f2

SHA1
3e985c7dc13b1b7ac04182811ebe663b4c0dbe3e

SHA256
22f598178f1ad2bd754fb805dc4e04e77dcdcd3edeacc8c2807a0540dce539c7

SHA512
d1e181c44d4c336e44f09ee67883e6dc16167d2e850bee1901ad32f2580d74e7d0ea00bb4a5767e571305a08c44f7d9e7777ba0015fba62cdfc856e1723ccd9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe

Filesize
468KB

MD5
01bfd94d011f7939bb0d78cabebb09b2

SHA1
cae3c16d13d84ee9e853ab2bcc18adf851f3ba14

SHA256
69a2ad75a15841072360e360ccc30bf8f906957c308a86c150471c513dc99af3

SHA512
b145c3e0084ea9308a3b1fa437ce96bca8e7d3ddd9868236553ecd6880023b5998d1eb05cb32389527b89da6f7f4dd9424d71c5a79c0d321c3f444054fa0a6ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe

Filesize
468KB

MD5
e84fdf45b037bcde58a5780f681a93f8

SHA1
0c0312c1515e212d37cac0279925343932328f92

SHA256
da6da4fbd55b1624fb2cac9188468cd5b5710c699c79e0d44a1e997eb6938dc8

SHA512
980385f2cfd12a05fce58c5e5689e16b8c344250f1f2f128deccbf5f5de3ca7d567959cdcb2d39d406a44a3462e9f9d57d5c3afd96198b31cfa8230b40547c6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25481.exe

Filesize
468KB

MD5
ff461c18a25391208b0a8ad398b22de5

SHA1
bf1f5fa67deaacb9890ace39018efc07ae192d6b

SHA256
f8695e8432e17b816c4c8c124b2efb94577c6b61841c8993fbf50f41cf0118f3

SHA512
3007025a5b4c0035aed6ae478fe36d7883376b5434a95640dc6a6e46f26f9a0bcdd8c5ca68df54a71911946dadf96d5d070d5ee1c1218c03c0c5cd9b0697730b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe

Filesize
468KB

MD5
2e96cb0eb55d98645728237ce403a535

SHA1
e9edff8ebc28be30d4bbcc3e06e10723e4b522be

SHA256
27a8ad504556798b67d383a4d66b329c99fd33f2307f4df54d1ccc5a3ec00ef8

SHA512
05afa2116bdbab66ede9ba72a2183545471fcfd3ed3d8b5539a276165d4868ae05c73e35e6a24d3a376f760323c4d8b0058e44d8026a82f237807c3838f0ecdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe

Filesize
468KB

MD5
0dac119db768201907ac58aac78dcd02

SHA1
250cde2379c5cc5f32cfc0347fa367400f364c94

SHA256
4a244ce0508810a9c0d126692115969f9a62903839b9eaa52eacf11dce857900

SHA512
5ce0c7d203b3aada8968e5fcaea968a0ccc7ba162190055be2df16767dea4e5041f37186419c37f4f0f25dc6ba086f954a2313c02db142f82d21c13ff0a9552c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe

Filesize
468KB

MD5
ee7bfbebe235f5e08acc662292df8429

SHA1
692b05b238ca190e77619470f7abf95f04afba1d

SHA256
84f0509e1818733ea5d48aa9b28bee8a1920aecaf0c8fd6c1ed516babba29d3a

SHA512
86c07d87c72da3cce78c0f870a711404ec70e81d4ef31dfbc33d208f9178e263fcc00242f03fc96592d379631366df8aebcd49cfd7b787fdbac677cd5569ee9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe

Filesize
468KB

MD5
b8c0fa7e6c5ed3e0bbd28b8416383ff9

SHA1
3f326edb247f1ca9e50718f70bf4a72add6a1eb8

SHA256
8f3dc750fc6ba0b00b9f59384ac2487f97c82e7e74f95d7aa1ff96bd29032e95

SHA512
36f4c66965787a9a1d4d6a57dfb148c7829d24782dfec51ac6d2a0c8763a22d17f8a703e1e58baac5ed2417f90886218251c49bd4e34e1d1d2a91d03a3384084

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31567.exe

Filesize
468KB

MD5
d7e790233d211b77ea2e6bc794a82594

SHA1
69df66aa1003a4058495138d3e6eb6f2159be30a

SHA256
185fc4b8dc3fbbc62024e39704a3789cdd63ad4eb7c4ce0fd090d939d953e2a6

SHA512
806e493a938e619aa098a4507432d5bf561410f6c06e30170ffd6f1fe573c769b6433eb56b1303b086accf35936d8008f650e4b35fd778f33fedb1c3d684d14c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe

Filesize
468KB

MD5
5c647bc9c62f4bbfb12d84d552abf3eb

SHA1
5c151689de75034bf7b7eb9ba5ec60c46cea17e1

SHA256
d9f9f3727fd8085e226420988ac780d1523e9426b35b8566719adb345864e137

SHA512
0dab510c7e84716986b9c6aaeaf9d8d4f104d59dfcd50f9b465c4f8b64dbcec31daab6619fdedbe87f04f4402b49cd2e27b4d3ab45731e6d03bd22a01df7c02f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe

Filesize
468KB

MD5
e8e7b5e6d5a1be3ade8398a0633cf830

SHA1
563d4ab709576bce9aad61a1ce91dbeee90fc6ce

SHA256
26b0800180bf81ddbf09951651e0d1859c76feaa90bdea88e13d696158eeaef6

SHA512
a0f6a02ccfd69188f60f91b3d65fbff23eb5506db3682df645188b1814e4081f0e054091a9c27e50a4c960fe461d9b232a804fda69b92ba438d4299fde5cc465

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe

Filesize
468KB

MD5
ba12e842f30e6470e1da85f118512d37

SHA1
2e073bb75aa831d2b0632804743e58aee23955c3

SHA256
cf19434a45c8df209d82c2ba5d192f6a483b25292b235ec4da4cf4a866f51efc

SHA512
0cee3b50db16bcbc66867379ce581c8b5e448eb58ad84003ca37b796e32a1baa19c66ff49d72682bfe0bde6cfb258650769c95e456a5338811f2f0aade54b2e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39735.exe

Filesize
468KB

MD5
0a4883ac404aba266840288fee83fbf2

SHA1
2f586aa27df9514b61c867dd8ca3d9a33f98bb16

SHA256
f4cbd139a30a748912bf2223a3306e5fc20c7b8fe989e86344d973433735a8d1

SHA512
4b2daee05ca31620c02f0a947b1b09d03b1fcdc6ff71121862ab0cf6f3e92ec6ba9f505457a5c047a7e83fad5ba54104c65513fa923aaa3daae50e5e0fc3685b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42217.exe

Filesize
468KB

MD5
80e9b96a44c1d1445338e5e521d084e8

SHA1
6bfbe737f5fb7a3036fb9f93615206362bdc6716

SHA256
daa367ee119c78cb551436eed81276daaefbf2a0476b0316f0a8a5972209ab99

SHA512
572d45c9fb389d21e20ee9a42c25972d9cba081b743e1396b26aea36cf8060689ada5d9d2f07645a2475af7c0f946602f0b5fd544858daecd7142ca7b7dd254f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42503.exe

Filesize
468KB

MD5
f88df097871fbffdb2b41a8cc03c8be0

SHA1
52373bd4b3df95953b6e65fd20261a0159d0a333

SHA256
126c4e569c52f9266e84b9b73952667a87e5af46431e38a40cb4d8479d60ff78

SHA512
8410baa905528fa21058169e7c5ab5ea0990f28ac35ba0af7a4c2f5cfe84e982d2d955d110bd6a8c7014994d54f24ed1307ffd429a2b99f736c7e32e2ed0dd25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43000.exe

Filesize
468KB

MD5
760a77de197cab15af77f58b509c20c3

SHA1
91b6f10f21fe5e3bfe0810bcb46539e915d03eef

SHA256
01a2638ad9736ab77362e7b73e36e2e565e09acebbadf0b8ba08b4907a689458

SHA512
fa67d6eefc06a1b58bef634b065c790d8539772160ef1813da900b65331fcd53937664bc5bc04598e1e8369545d9ba323321909e9d656e31ff58bfefbb2b5dec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43523.exe

Filesize
468KB

MD5
619b1d97c07abe74e8664579c7573bfa

SHA1
eff260c6ca5c1421827cd2189f2c8c765845238a

SHA256
08b931e0397a81ad6a1239fac2d4d6c1d72cc9b133f178e4ef520bcf6ad4e872

SHA512
4b0c995bbc27995784a33827db9a35f3cdb7b0fa084a66f7f7a4ceac9098742a8249d698212a1de054dd5623e6807ff33cc9aae685a4ef5ebd8a665677ab4e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45688.exe

Filesize
468KB

MD5
451176eb57875be610097c80bdd1795f

SHA1
7e33880697651fc635949595738ec37b321c16cb

SHA256
e90156ca31ef6afe7323cbc364d0609f41559030975ebf0c87dc7f4f3f2bb4b1

SHA512
26425a279cbbe0cfca0c2c8b4338df2307b65610f53500f43529a7c5bda75262ca44a1eedf9b67b590c81f937315185ea58767629d5a278ea9e63f649f8decf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46109.exe

Filesize
468KB

MD5
9acb3d48d13d0713c39def1f85dba4e9

SHA1
59280c11199eae60bcd8c462f63e6f46d640b5f9

SHA256
eedfbeb9d549a69660f857708b3b7f3f89bf34757b1f65f46b7ecd561ff4be08

SHA512
25f15973c7c4639a7903e57d66cb14d5c61bd4166f462bb89d63f505eda52300a4e68378cf58444de7083e7ed07fabc8e514724a771ec925083b0ce5091569e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe

Filesize
468KB

MD5
5012d39bc52c36365fa9a4f06dee3781

SHA1
8e2e253895ced5102222f6bb1e7e8ac6d9939f1b

SHA256
17fb4cbd7a07cea9729e7d2ac6aa4122907b0c21fb4fc10021330b37c7438a70

SHA512
5bfda4d859278608d865bf94f42b5f5900c0502e85b04495e73faa0024bd91812e3661f10e42f7a5a34dc1bda24c3ffa20291c6a7bd910065a087b5b52a1b4d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe

Filesize
468KB

MD5
c64d638883d21de71fb8afe9a42822e1

SHA1
8b317f42c07879d6daa3a42836f71caba834a27b

SHA256
0aaa659f2270b9d383e15066e0c1d4069dc552ce32df804fe104e4eab80d0580

SHA512
0be283abb102e25bd9dd4f45174bee054b732e8e6930c6f595585b96c45d0aa9468333e5ac4abfeedbcfc4e8fe9b3dd5b2971d1241a7544d1c811451b7cb8bb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe

Filesize
468KB

MD5
35038391e39442b6dba702b629a849a5

SHA1
a3a596658f1927a03ff8f4b151e6f5dcaf88cb70

SHA256
1fb128c66d0dcc392bf81fb0128da7f5f4c99991fc6e3874c2b44c1f5d6416c4

SHA512
8ce63a8e4ad38e3d96f90147667c18638fbb9938fd84de720caf4fd487bd6addb5dcfe8c6cf45d826d343ea17496fcad780128c0a556997e3e10b7dd1916b132

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe

Filesize
468KB

MD5
c1bc4476445044b8b01c08fc984d8b7a

SHA1
a62d2f2f4be6bc87bfb8852415e4f7a3932adaa5

SHA256
4a362c1d9e1fc4a631d6b84d0ffa2bc419a5f194228c75bd53f5fbe5ed2efd34

SHA512
3a0aa510d89dff30e1c4a10baaecd1a2c548f21a3aeb14055d4c411d4f2ffcbfe3595d21bee8a63b762fbca1dc3e812600dacb68bcf14fa636449694b0b844ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58241.exe

Filesize
468KB

MD5
3ccf98a821fa43a34d107da671a19c9d

SHA1
76a50aa8bb2cd08525c5c6a1ca622f5b2c868101

SHA256
8d752656917508820bd34d871984e17db21cbcbc9e9883b4b3efd6a9757526e0

SHA512
65f1a704cd1603607e3021be2b3c813f643adcdaacabb595aa2c11bb127030a35a6a1100827d4c70f7348beeb56e76446c7371cf4fb926577ca457d51df22448

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62320.exe

Filesize
468KB

MD5
526e9b12d72c25c133f056a7d20ff6c8

SHA1
d3113a233039ce220c26855c67b9463fd62a3ad2

SHA256
16ae62cc4e93a6f4e2d78197176eac31cda1db5f9aef0efcb87786055a1f6847

SHA512
6cf9f1c5b82091f4ffcbcf611271573450e176113e06cb0dbc4b5825ae7bf86f6c9f93508433f6a45179556b122ba6058f91a6d664613ed45b9a132039711b96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe

Filesize
468KB

MD5
407581ec8a930ad8ec47f7bfbe4b154a

SHA1
c2b4bff3e292042c3292b55c8d871fb9691613c5

SHA256
b3b96195160c4d3390ea1eea6a1a3a60eeddd65bf1b3dd2adffb9fe0a30dd90b

SHA512
d5f9d43952bc17883ea86a87f18f5dc22070866ac5f0587a0e75723726315190a61b773b8c9ea43ea068f358026664475b26cc56c9513769a3f28c1509f4eb11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9907.exe

Filesize
468KB

MD5
6d6ac92cd09c9bc1aa6da1b5e46dd9dc

SHA1
ee1000a9b2137fb2f8880837acfbeb22360091f9

SHA256
2e43321de6deb5d448e5a28ade685a2cafc68f9ecdf4a785de3449311c92b0d2

SHA512
7287a2c29a949083a5f50ca2cb0a280cddd2b5e3d47eeb6aee774ec3bbef80369e97912ef6dcd79eb551a6ef069108546d89ea8a6d8865f96bfb6336457405e6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads