59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25

Analysis

max time kernel
120s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe
Size

468KB
MD5

1d3ee9cd7624ecb3755d133f6d20cab0
SHA1

59a6368fb12738be02783b7eaf0e7028b1b7e1bb
SHA256

59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25
SHA512

94e9c4e01dead12f3c249e803667c45a79435cddfc39b9fd729e5e0e67c4f9703b779c485940d3d9721ae95f49fb91346f7adfac5f6fe4e6ba45f0504e2bc540
SSDEEP

3072:1G3HogIKIo5TtbY2HzcOcfC/zChaP0ptnLHeTVFNgq5LgC2uvslL:1G3oDoTtxH4Ocf8YglgqVD2uv

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4288	Unicorn-47244.exe
4840	Unicorn-51660.exe
3232	Unicorn-15458.exe
3456	Unicorn-61084.exe
3608	Unicorn-44364.exe
2580	Unicorn-24498.exe
3444	Unicorn-21897.exe
3008	Unicorn-31012.exe
672	Unicorn-44011.exe
4516	Unicorn-63876.exe
640	Unicorn-185.exe
1616	Unicorn-6050.exe
2792	Unicorn-51987.exe
1388	Unicorn-6315.exe
1156	Unicorn-20967.exe
3880	Unicorn-31513.exe
5004	Unicorn-3671.exe
3124	Unicorn-48233.exe
3856	Unicorn-50079.exe
4900	Unicorn-25265.exe
2972	Unicorn-25265.exe
4896	Unicorn-33817.exe
4412	Unicorn-58129.exe
3208	Unicorn-43831.exe
816	Unicorn-49961.exe
4916	Unicorn-30095.exe
3204	Unicorn-24694.exe
3916	Unicorn-17407.exe
1284	Unicorn-13759.exe
4832	Unicorn-32961.exe
3956	Unicorn-18662.exe
4392	Unicorn-23641.exe
1920	Unicorn-3775.exe
1480	Unicorn-24025.exe
1376	Unicorn-60847.exe
4172	Unicorn-42473.exe
2340	Unicorn-14439.exe
4308	Unicorn-34113.exe
4928	Unicorn-34424.exe
5044	Unicorn-9223.exe
1436	Unicorn-11144.exe
2860	Unicorn-7807.exe
2780	Unicorn-51985.exe
4636	Unicorn-57200.exe
1292	Unicorn-11528.exe
1564	Unicorn-11528.exe
2944	Unicorn-27792.exe
4344	Unicorn-28057.exe
3496	Unicorn-65176.exe
4844	Unicorn-3168.exe
3772	Unicorn-3168.exe
2368	Unicorn-60537.exe
4324	Unicorn-29902.exe
4608	Unicorn-7999.exe
4644	Unicorn-7999.exe
4100	Unicorn-18934.exe
184	Unicorn-21734.exe
4884	Unicorn-44585.exe
3512	Unicorn-12296.exe
4552	Unicorn-61232.exe
3612	Unicorn-41631.exe
3044	Unicorn-1928.exe
2424	Unicorn-22903.exe
4860	Unicorn-36639.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
13828	7060	WerFault.exe	291
16872	6616	WerFault.exe	284
16480	6488	WerFault.exe	283
16616	7796	WerFault.exe	324
16788	6960	WerFault.exe	400
17176	16372	WerFault.exe	772

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2359.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3656	dwm.exe
Token: SeChangeNotifyPrivilege	3656	dwm.exe
Token: 33	3656	dwm.exe
Token: SeIncBasePriorityPrivilege	3656	dwm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6476	sihost.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5084	59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe
4288	Unicorn-47244.exe
4840	Unicorn-51660.exe
3232	Unicorn-15458.exe
3608	Unicorn-44364.exe
3456	Unicorn-61084.exe
2580	Unicorn-24498.exe
3444	Unicorn-21897.exe
3008	Unicorn-31012.exe
672	Unicorn-44011.exe
1616	Unicorn-6050.exe
2792	Unicorn-51987.exe
640	Unicorn-185.exe
1388	Unicorn-6315.exe
4516	Unicorn-63876.exe
1156	Unicorn-20967.exe
3880	Unicorn-31513.exe
5004	Unicorn-3671.exe
3124	Unicorn-48233.exe
3856	Unicorn-50079.exe
4412	Unicorn-58129.exe
4896	Unicorn-33817.exe
2972	Unicorn-25265.exe
4900	Unicorn-25265.exe
3208	Unicorn-43831.exe
1284	Unicorn-13759.exe
816	Unicorn-49961.exe
4916	Unicorn-30095.exe
3916	Unicorn-17407.exe
4832	Unicorn-32961.exe
3956	Unicorn-18662.exe
4392	Unicorn-23641.exe
1920	Unicorn-3775.exe
1480	Unicorn-24025.exe
4172	Unicorn-42473.exe
2340	Unicorn-14439.exe
1376	Unicorn-60847.exe
4308	Unicorn-34113.exe
4928	Unicorn-34424.exe
5044	Unicorn-9223.exe
1436	Unicorn-11144.exe
2860	Unicorn-7807.exe
2780	Unicorn-51985.exe
2944	Unicorn-27792.exe
4344	Unicorn-28057.exe
1564	Unicorn-11528.exe
1292	Unicorn-11528.exe
4636	Unicorn-57200.exe
4844	Unicorn-3168.exe
3496	Unicorn-65176.exe
2368	Unicorn-60537.exe
4608	Unicorn-7999.exe
3772	Unicorn-3168.exe
184	Unicorn-21734.exe
4324	Unicorn-29902.exe
4100	Unicorn-18934.exe
4644	Unicorn-7999.exe
4884	Unicorn-44585.exe
3512	Unicorn-12296.exe
4552	Unicorn-61232.exe
3612	Unicorn-41631.exe
3044	Unicorn-1928.exe
2060	Unicorn-42769.exe
4860	Unicorn-36639.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4288	5084	59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe	84
PID 5084 wrote to memory of 4288	5084	59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe	84
PID 5084 wrote to memory of 4288	5084	59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe	84
PID 4288 wrote to memory of 4840	4288	Unicorn-47244.exe	85
PID 4288 wrote to memory of 4840	4288	Unicorn-47244.exe	85
PID 4288 wrote to memory of 4840	4288	Unicorn-47244.exe	85
PID 5084 wrote to memory of 3232	5084	59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe	86
PID 5084 wrote to memory of 3232	5084	59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe	86
PID 5084 wrote to memory of 3232	5084	59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe	86
PID 4840 wrote to memory of 3456	4840	Unicorn-51660.exe	87
PID 4840 wrote to memory of 3456	4840	Unicorn-51660.exe	87
PID 4840 wrote to memory of 3456	4840	Unicorn-51660.exe	87
PID 3232 wrote to memory of 3608	3232	Unicorn-15458.exe	88
PID 3232 wrote to memory of 3608	3232	Unicorn-15458.exe	88
PID 3232 wrote to memory of 3608	3232	Unicorn-15458.exe	88
PID 4288 wrote to memory of 2580	4288	Unicorn-47244.exe	89
PID 4288 wrote to memory of 2580	4288	Unicorn-47244.exe	89
PID 4288 wrote to memory of 2580	4288	Unicorn-47244.exe	89
PID 5084 wrote to memory of 3444	5084	59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe	90
PID 5084 wrote to memory of 3444	5084	59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe	90
PID 5084 wrote to memory of 3444	5084	59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe	90
PID 3456 wrote to memory of 3008	3456	Unicorn-61084.exe	95
PID 3456 wrote to memory of 3008	3456	Unicorn-61084.exe	95
PID 3456 wrote to memory of 3008	3456	Unicorn-61084.exe	95
PID 4840 wrote to memory of 672	4840	Unicorn-51660.exe	96
PID 4840 wrote to memory of 672	4840	Unicorn-51660.exe	96
PID 4840 wrote to memory of 672	4840	Unicorn-51660.exe	96
PID 2580 wrote to memory of 4516	2580	Unicorn-24498.exe	97
PID 2580 wrote to memory of 4516	2580	Unicorn-24498.exe	97
PID 2580 wrote to memory of 4516	2580	Unicorn-24498.exe	97
PID 4288 wrote to memory of 640	4288	Unicorn-47244.exe	98
PID 4288 wrote to memory of 640	4288	Unicorn-47244.exe	98
PID 4288 wrote to memory of 640	4288	Unicorn-47244.exe	98
PID 5084 wrote to memory of 1616	5084	59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe	99
PID 5084 wrote to memory of 1616	5084	59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe	99
PID 5084 wrote to memory of 1616	5084	59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe	99
PID 3232 wrote to memory of 2792	3232	Unicorn-15458.exe	100
PID 3232 wrote to memory of 2792	3232	Unicorn-15458.exe	100
PID 3232 wrote to memory of 2792	3232	Unicorn-15458.exe	100
PID 3444 wrote to memory of 1388	3444	Unicorn-21897.exe	101
PID 3444 wrote to memory of 1388	3444	Unicorn-21897.exe	101
PID 3444 wrote to memory of 1388	3444	Unicorn-21897.exe	101
PID 3608 wrote to memory of 1156	3608	Unicorn-44364.exe	103
PID 3608 wrote to memory of 1156	3608	Unicorn-44364.exe	103
PID 3608 wrote to memory of 1156	3608	Unicorn-44364.exe	103
PID 3008 wrote to memory of 3880	3008	Unicorn-31012.exe	104
PID 3008 wrote to memory of 3880	3008	Unicorn-31012.exe	104
PID 3008 wrote to memory of 3880	3008	Unicorn-31012.exe	104
PID 3456 wrote to memory of 5004	3456	Unicorn-61084.exe	105
PID 3456 wrote to memory of 5004	3456	Unicorn-61084.exe	105
PID 3456 wrote to memory of 5004	3456	Unicorn-61084.exe	105
PID 672 wrote to memory of 3124	672	Unicorn-44011.exe	106
PID 672 wrote to memory of 3124	672	Unicorn-44011.exe	106
PID 672 wrote to memory of 3124	672	Unicorn-44011.exe	106
PID 4840 wrote to memory of 3856	4840	Unicorn-51660.exe	107
PID 4840 wrote to memory of 3856	4840	Unicorn-51660.exe	107
PID 4840 wrote to memory of 3856	4840	Unicorn-51660.exe	107
PID 1388 wrote to memory of 4896	1388	Unicorn-6315.exe	108
PID 1388 wrote to memory of 4896	1388	Unicorn-6315.exe	108
PID 1388 wrote to memory of 4896	1388	Unicorn-6315.exe	108
PID 2792 wrote to memory of 2972	2792	Unicorn-51987.exe	110
PID 1616 wrote to memory of 4900	1616	Unicorn-6050.exe	109
PID 2792 wrote to memory of 2972	2792	Unicorn-51987.exe	110
PID 1616 wrote to memory of 4900	1616	Unicorn-6050.exe	109

C:\Users\Admin\AppData\Local\Temp\59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe
"C:\Users\Admin\AppData\Local\Temp\59a41b94721628465933402fef1c93aae746bad21e3955668f1f1fd0b397fe25N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51660.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31513.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        8⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        9⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        10⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
        10⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        10⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        9⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38808.exe
        9⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12573.exe
        9⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20790.exe
        8⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40697.exe
        9⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        9⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2973.exe
        9⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53983.exe
        8⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11421.exe
        8⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22903.exe
        7⤵
        Executes dropped EXE
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
        8⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7071.exe
        9⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        10⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4774.exe
        9⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        9⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7159.exe
        8⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
        9⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        9⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        8⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42752.exe
        8⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
        8⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        8⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46831.exe
        7⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42297.exe
        8⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11472.exe
        9⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        9⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
        9⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20719.exe
        8⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        8⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12881.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
        7⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        8⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58023.exe
        8⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        8⤵
        
        PID:17384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        7⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3775.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1928.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
        10⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        10⤵
        
        PID:13180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6488 -s 652
        10⤵
        Program crash
        
        PID:16480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        9⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51775.exe
        9⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        9⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14262.exe
        8⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        8⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26743.exe
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
        8⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
        9⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exe
        9⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62943.exe
        9⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5535.exe
        8⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe
        8⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        8⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        7⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        7⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        7⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6936.exe
        8⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        9⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        9⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
        9⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        8⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
        8⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44928.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52617.exe
        8⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27446.exe
        7⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64760.exe
        7⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        7⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27424.exe
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58825.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe
        8⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
        8⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe
        7⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        7⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        7⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42215.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3934.exe
        7⤵
        
        PID:17812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        6⤵
        
        PID:16328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
        6⤵
        
        PID:17476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3671.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24025.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42769.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe
        9⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        10⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3430.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        9⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14943.exe
        8⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        8⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        8⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33095.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        8⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        9⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        9⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
        9⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37247.exe
        8⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
        8⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61735.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        7⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8601.exe
        7⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6567.exe
        6⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51233.exe
        8⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5927.exe
        8⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        8⤵
        
        PID:16276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23111.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        7⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48564.exe
        7⤵
        
        PID:17428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5990.exe
        6⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43937.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
        7⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
        7⤵
        
        PID:16704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35992.exe
        6⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        7⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        7⤵
        
        PID:17412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28398.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24671.exe
        6⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2773.exe
        6⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        6⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        8⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        8⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        8⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11895.exe
        7⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        7⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17617.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        7⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        7⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        7⤵
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        6⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5648.exe
        7⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11895.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13411.exe
        6⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        5⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12504.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        7⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2191.exe
        7⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        7⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31279.exe
        6⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41407.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58231.exe
        7⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5210.exe
        7⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63671.exe
        6⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33297.exe
        6⤵
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
        6⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38492.exe
        6⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3879.exe
        5⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5680.exe
        5⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
        5⤵
        
        PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42473.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26817.exe
        7⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3184.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60273.exe
        9⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63400.exe
        9⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
        9⤵
        
        PID:16736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        8⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49872.exe
        8⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        8⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16390.exe
        8⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28528.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        8⤵
        
        PID:17344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        8⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11895.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        7⤵
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
        6⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        8⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        9⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        8⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9206.exe
        8⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61456.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
        8⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        8⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        8⤵
        
        PID:17156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7796 -s 640
        8⤵
        Program crash
        
        PID:16616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        7⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47272.exe
        7⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        7⤵
        
        PID:16324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exe
        7⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
        7⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        7⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42240.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53287.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28319.exe
        6⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12394.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14439.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
        6⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44217.exe
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58825.exe
        8⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        9⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        8⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        8⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5150.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        7⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        7⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21234.exe
        7⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11895.exe
        6⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11366.exe
        5⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        7⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        7⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        7⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        6⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61071.exe
        6⤵
        
        PID:17520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16655.exe
        5⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
        5⤵
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34935.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50079.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        6⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
        8⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17007.exe
        9⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        9⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
        8⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        8⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
        8⤵
        
        PID:17500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        8⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2191.exe
        7⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7532.exe
        7⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        6⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43169.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44449.exe
        8⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        7⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52711.exe
        6⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13208.exe
        7⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51147.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        7⤵
        
        PID:16916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        7⤵
        
        PID:17484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63168.exe
        5⤵
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35857.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59209.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61864.exe
        7⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        7⤵
        
        PID:17460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7159.exe
        6⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
        7⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52255.exe
        6⤵
        
        PID:16628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47063.exe
        6⤵
        
        PID:15672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55487.exe
        6⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
        5⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        6⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37956.exe
        7⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36693.exe
        6⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21959.exe
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        5⤵
        
        PID:13820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        5⤵
        
        PID:17028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8492.exe
        5⤵
        
        PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17497.exe
        5⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe
        6⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        7⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
        7⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35622.exe
        6⤵
        
        PID:14744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43577.exe
        6⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exe
        5⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exe
        5⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21812.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40511.exe
        5⤵
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42214.exe
        5⤵
        
        PID:16972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        5⤵
        
        PID:17196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41815.exe
      4⤵
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60273.exe
        6⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41377.exe
        7⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
        7⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
        6⤵
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        6⤵
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:16728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        6⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        5⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52897.exe
        6⤵
        
        PID:12788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        6⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
        5⤵
        
        PID:372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62000.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65040.exe
        5⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
        5⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        5⤵
        
        PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
      4⤵
      PID:7976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
      4⤵
      PID:14648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
      4⤵
      PID:4972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24498.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49961.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        7⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        8⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        9⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63400.exe
        9⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        9⤵
        
        PID:16556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        9⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe
        8⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        8⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13027.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27143.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50097.exe
        8⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        8⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        8⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57127.exe
        7⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35622.exe
        7⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
        7⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50864.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe
        8⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
        8⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30846.exe
        8⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63624.exe
        8⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe
        8⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe
        7⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
        7⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28102.exe
        6⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        7⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        7⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37961.exe
        7⤵
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exe
        6⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61865.exe
        7⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38607.exe
        6⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28319.exe
        6⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        6⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4808.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        8⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe
        8⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
        8⤵
        
        PID:17036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61691.exe
        8⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        7⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
        6⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        7⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        7⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4412.exe
        7⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13727.exe
        6⤵
        
        PID:14916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
        6⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7422.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
        7⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40727.exe
        7⤵
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        6⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6519.exe
        6⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54291.exe
        6⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15519.exe
        5⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29601.exe
        6⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        5⤵
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22071.exe
        5⤵
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56556.exe
        5⤵
        
        PID:17452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35015.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27985.exe
        7⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        7⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36887.exe
        7⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        7⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30126.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe
        6⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19295.exe
        6⤵
        
        PID:17356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-895.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2855.exe
        6⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
        6⤵
        
        PID:15268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        6⤵
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        5⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        5⤵
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26783.exe
        5⤵
        
        PID:16172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        5⤵
        
        PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe
        5⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15016.exe
        6⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40535.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12590.exe
        6⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27639.exe
        5⤵
        
        PID:14432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
        5⤵
        
        PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        5⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44233.exe
        6⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6960 -s 484
        7⤵
        Program crash
        
        PID:16788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        6⤵
        
        PID:13004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56959.exe
        5⤵
        
        PID:13084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
        5⤵
        
        PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
      4⤵
      PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13776.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        5⤵
        
        PID:13496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
      4⤵
      PID:11028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
      4⤵
      PID:14084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
      4⤵
      PID:16464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11144.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        6⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exe
        8⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe
        9⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39035.exe
        9⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25752.exe
        8⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
        7⤵
        
        PID:12440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59624.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        7⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35025.exe
        8⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        8⤵
        
        PID:16100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
        8⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        7⤵
        
        PID:12744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7734.exe
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27454.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49332.exe
        6⤵
        
        PID:15088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32607.exe
        5⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe
        7⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34198.exe
        7⤵
        
        PID:16264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        7⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exe
        6⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4080.exe
        7⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
        7⤵
        
        PID:17240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        7⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        6⤵
        
        PID:10616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exe
        6⤵
        
        PID:16584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7824.exe
        6⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        5⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32751.exe
        6⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53584.exe
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
        5⤵
        
        PID:14328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        5⤵
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        5⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
        6⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
        7⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
        7⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        7⤵
        
        PID:16288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        7⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29166.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16385.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        6⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        7⤵
        
        PID:16724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        6⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        6⤵
        
        PID:17396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47719.exe
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        5⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        5⤵
        
        PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
      4⤵
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
        5⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31582.exe
        6⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62228.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        5⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        6⤵
        
        PID:16184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28532.exe
        6⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        5⤵
        
        PID:12676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
        5⤵
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4023.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        5⤵
        
        PID:17268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28738.exe
        5⤵
        
        PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
      4⤵
      PID:9644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59440.exe
      4⤵
      PID:13992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59329.exe
      4⤵
      PID:17076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4034.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17407.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe
        5⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3120.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32959.exe
        6⤵
        
        PID:16672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62963.exe
        6⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
        6⤵
        
        PID:17340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8281.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23031.exe
        5⤵
        
        PID:16244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3608.exe
        6⤵
        
        PID:13372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        5⤵
        
        PID:11260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        5⤵
        
        PID:16304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39995.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35503.exe
      4⤵
      PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62025.exe
        5⤵
        
        PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15471.exe
        5⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        5⤵
        
        PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26872.exe
      4⤵
      PID:10976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
      4⤵
      PID:15572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47658.exe
      4⤵
      PID:7604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18934.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        5⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27934.exe
        5⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
        5⤵
        
        PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
      4⤵
      PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        5⤵
        
        PID:13764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        5⤵
        
        PID:16512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
      4⤵
      PID:11052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
      4⤵
      PID:4144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60832.exe
    3⤵
    PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
      4⤵
      PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        5⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        6⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        6⤵
        
        PID:17252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        5⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
        5⤵
        
        PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
      4⤵
      PID:9184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
      4⤵
      PID:12832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
      4⤵
      PID:548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
    3⤵
    PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3120.exe
      4⤵
      PID:12216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
      4⤵
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
      4⤵
      PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
    3⤵
    PID:10904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12271.exe
    3⤵
    PID:14296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58779.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44364.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32961.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44585.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10200.exe
        8⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
        8⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        8⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
        8⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
        7⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        7⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9790.exe
        7⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32052.exe
        7⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        8⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        8⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64863.exe
        8⤵
        
        PID:16564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
        8⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
        7⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
        7⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
        7⤵
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        6⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62025.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
        7⤵
        
        PID:16568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        6⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52082.exe
        6⤵
        
        PID:17420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27934.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
        7⤵
        
        PID:16704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29166.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28118.exe
        6⤵
        
        PID:13320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49140.exe
        6⤵
        
        PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45873.exe
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58023.exe
        7⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        7⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9206.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
        6⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
        5⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37956.exe
        6⤵
        
        PID:16672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39559.exe
        5⤵
        
        PID:16356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18662.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60031.exe
        7⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        7⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63671.exe
        6⤵
        
        PID:14248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52016.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        6⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        7⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32383.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
        7⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16372 -s 436
        7⤵
        Program crash
        
        PID:17176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64006.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        5⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
        6⤵
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62943.exe
        6⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25918.exe
        5⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26509.exe
        5⤵
        
        PID:17444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14512.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        6⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27537.exe
        7⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47864.exe
        7⤵
        
        PID:17116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2855.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
        6⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        6⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61648.exe
        5⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        6⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50064.exe
        6⤵
        
        PID:16592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60599.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        5⤵
        
        PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14518.exe
      4⤵
      PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        5⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        5⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        5⤵
        
        PID:17364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
      4⤵
      PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
        5⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
        5⤵
        
        PID:17392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9904.exe
      4⤵
      PID:10356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
      4⤵
      PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51987.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3656.exe
        6⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        8⤵
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12210.exe
        8⤵
        
        PID:17508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34839.exe
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        7⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        7⤵
        
        PID:17204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63611.exe
        7⤵
        
        PID:17712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        7⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        7⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29255.exe
        7⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
        7⤵
        
        PID:17284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60136.exe
        6⤵
        
        PID:13832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9790.exe
        6⤵
        
        PID:17016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        6⤵
        
        PID:17352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        5⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9152.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe
        8⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        8⤵
        
        PID:17276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
        8⤵
        
        PID:17008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        7⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
        7⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47144.exe
        6⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exe
        7⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31329.exe
        7⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        6⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        6⤵
        
        PID:16400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55404.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        5⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55143.exe
        6⤵
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        5⤵
        
        PID:9300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        5⤵
        
        PID:14304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31460.exe
        5⤵
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57200.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27585.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        6⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        7⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        7⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        7⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        6⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54291.exe
        6⤵
        
        PID:16768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53465.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        6⤵
        
        PID:13452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        5⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62431.exe
        5⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40095.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        5⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65248.exe
        6⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
        6⤵
        
        PID:16672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        6⤵
        
        PID:17356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2766.exe
        5⤵
        
        PID:15600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exe
      4⤵
      PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31521.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exe
      4⤵
      PID:11004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
      4⤵
      PID:15488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe
      4⤵
      PID:4404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5192.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        6⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        7⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        7⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        7⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
        6⤵
        
        PID:14980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6199.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        5⤵
        
        PID:10864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47272.exe
        5⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55341.exe
        5⤵
        
        PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
      4⤵
      PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        5⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5662.exe
        6⤵
        
        PID:16688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        6⤵
        
        PID:17820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60135.exe
        5⤵
        
        PID:15628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
        5⤵
        
        PID:17336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19934.exe
      4⤵
      PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41569.exe
        5⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31527.exe
        5⤵
        
        PID:17144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      4⤵
      PID:10836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38607.exe
      4⤵
      PID:15412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
      4⤵
      PID:17788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
      4⤵
      PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12343.exe
        5⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49249.exe
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12189.exe
        6⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2358.exe
        5⤵
        
        PID:10444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29872.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
        5⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        6⤵
        
        PID:17468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16415.exe
        5⤵
        
        PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
      4⤵
      PID:9592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        5⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        5⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14338.exe
        5⤵
        
        PID:17372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
      4⤵
      PID:13792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
      4⤵
      PID:3552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
    3⤵
    PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
      4⤵
      PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1280.exe
        5⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        5⤵
        
        PID:12516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
      4⤵
      PID:9280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe
      4⤵
      PID:13928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
      4⤵
      PID:17132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
      4⤵
      PID:16844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62000.exe
    3⤵
    PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
      4⤵
      PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42057.exe
        5⤵
        
        PID:15076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
      4⤵
      PID:12904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
      4⤵
      PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
    3⤵
    PID:9512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30470.exe
    3⤵
    PID:13772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
    3⤵
    PID:5680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21897.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21897.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
        6⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64201.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25593.exe
        8⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7596.exe
        9⤵
        
        PID:17236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        8⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10335.exe
        7⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        7⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        7⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        7⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        7⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30656.exe
        7⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        6⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7719.exe
        5⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-200.exe
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exe
        7⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exe
        7⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54291.exe
        7⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        6⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51147.exe
        7⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe
        6⤵
        
        PID:13888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
        6⤵
        
        PID:17008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53606.exe
        6⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27422.exe
        5⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
        6⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54168.exe
        5⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47055.exe
        5⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55404.exe
        5⤵
        
        PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65176.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41071.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
        6⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20394.exe
        7⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4023.exe
        6⤵
        
        PID:14608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        6⤵
        
        PID:17396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12402.exe
        6⤵
        
        PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3230.exe
        5⤵
        
        PID:13436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        5⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        5⤵
        
        PID:16428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39135.exe
      4⤵
      PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        5⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        6⤵
        
        PID:13744
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6616 -s 632
        6⤵
        Program crash
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29847.exe
        5⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7478.exe
        5⤵
        
        PID:14884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
      4⤵
      PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
        5⤵
        
        PID:12652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
      4⤵
      PID:12024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15058.exe
      4⤵
      PID:11496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        5⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        6⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52105.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62025.exe
        8⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62175.exe
        8⤵
        
        PID:15968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
        8⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
        7⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        7⤵
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        6⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28113.exe
        7⤵
        
        PID:13540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        6⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        6⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
        5⤵
        
        PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56847.exe
        5⤵
        
        PID:11636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41062.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        5⤵
        
        PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32223.exe
      4⤵
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        6⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62824.exe
        6⤵
        
        PID:17076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
        6⤵
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        5⤵
        
        PID:11128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38808.exe
        5⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
        5⤵
        
        PID:17360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53271.exe
      4⤵
      PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        5⤵
        
        PID:12244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48144.exe
        5⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
      4⤵
      PID:10644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
      4⤵
      PID:15296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43613.exe
      4⤵
      PID:4564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        5⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61633.exe
        6⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1423.exe
        6⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20719.exe
        5⤵
        
        PID:10556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45928.exe
        5⤵
        
        PID:16072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        5⤵
        
        PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14262.exe
      4⤵
      PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
      4⤵
      PID:12396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
    3⤵
    PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
      4⤵
      PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
        5⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
        6⤵
        
        PID:2372
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7060 -s 596
        5⤵
        Program crash
        
        PID:13828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32350.exe
      4⤵
      PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        5⤵
        
        PID:16432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4442.exe
        5⤵
        
        PID:452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38808.exe
      4⤵
      PID:14592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60464.exe
    3⤵
    PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63785.exe
      4⤵
      PID:17120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42978.exe
      4⤵
      PID:2748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
    3⤵
    PID:12192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
    3⤵
    PID:888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6050.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6050.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32991.exe
      4⤵
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
        5⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
        6⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64817.exe
        7⤵
        
        PID:12004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
        6⤵
        
        PID:9892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        6⤵
        
        PID:16336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exe
        5⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40697.exe
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        6⤵
        
        PID:16060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        6⤵
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        5⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe
        5⤵
        
        PID:16936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57023.exe
      4⤵
      PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        5⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        6⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
        5⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40889.exe
        5⤵
        
        PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe
      4⤵
      PID:14516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
      4⤵
      PID:2172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16729.exe
        5⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52105.exe
        6⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
        7⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe
        7⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        6⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5134.exe
        6⤵
        
        PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        5⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16697.exe
        6⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        6⤵
        
        PID:16616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        5⤵
        
        PID:12692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
      4⤵
      PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        5⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        5⤵
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
        5⤵
        
        PID:396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8798.exe
      4⤵
      PID:10052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51880.exe
      4⤵
      PID:14680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
      4⤵
      PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14630.exe
    3⤵
    PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
      4⤵
      PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1807.exe
        5⤵
        
        PID:12836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        5⤵
        
        PID:16696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
      4⤵
      PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
      4⤵
      PID:15288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27304.exe
      4⤵
      PID:17404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
    3⤵
    PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exe
      4⤵
      PID:15692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
      4⤵
      PID:17168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25222.exe
    3⤵
    PID:10500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46035.exe
    3⤵
    PID:5248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50745.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
      4⤵
      PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9152.exe
        5⤵
        
        PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        5⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47144.exe
      4⤵
      PID:9144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
      4⤵
      PID:13268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
    3⤵
    PID:7480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64631.exe
    3⤵
    PID:11600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57240.exe
    3⤵
    PID:16124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
    3⤵
    PID:16496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
    3⤵
    PID:17096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11626.exe
    3⤵
    PID:17156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42345.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42345.exe
  2⤵
  PID:4052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44409.exe
    3⤵
    PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exe
      4⤵
      PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
        5⤵
        
        PID:14400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56472.exe
      4⤵
      PID:9636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17286.exe
      4⤵
      PID:15972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
    3⤵
    PID:9044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
    3⤵
    PID:12700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe
  2⤵
  PID:6440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
    3⤵
    PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-536.exe
      4⤵
      PID:15480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
      4⤵
      PID:17272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
    3⤵
    PID:10392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
    3⤵
    PID:16320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe
    3⤵
    PID:2016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51239.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51239.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
    3⤵
    PID:12384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
    3⤵
    PID:6720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52775.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52775.exe
  2⤵
  PID:12256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
  2⤵
  PID:6816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
  2⤵
  PID:17092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
  2⤵
  PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 7060 -ip 7060
1⤵
PID:14140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6616 -ip 6616
1⤵
PID:16840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6588 -ip 6588
1⤵
PID:15076

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:6476

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe

Filesize
468KB

MD5
66b8272755ec0765ccca27d1b9242334

SHA1
9ea1e0aea99162f10906f23192db566929a414a4

SHA256
782470ca71589d83ec07bd0b7a86dc6f817cdc9f5c6d59003dad7be64b6051c6

SHA512
302c223d63c19b6905be485549761251311853c19207f55183e82598edd33d864c3f0c311b5b53e51d32f986e9310ace1519efab71d20f83c69022360550c303

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe

Filesize
468KB

MD5
ee511c244162d7104555f748e55a2851

SHA1
b3a0890baaa40c8c7c91c5a39ad94904f4eb8dac

SHA256
c6ff30d8980019bbc32e780f2990447eaa0c5e983772380ee5aebda28b810035

SHA512
7aa459b33f260c04a3634967177937260223bcebb750f975405af46f381fd1942eb037738181e654f7d9e115141b6d75b2bfe0fff0ec8f719a8d9d05feaa972c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe

Filesize
468KB

MD5
6ffc2678a7c2b784619aa6b4310071c8

SHA1
3a8b90f521e83d452c45033d75b4d338a2aa9cb5

SHA256
209e99429d6ffcf366d63394618b774617c7aa1405076a37d361d66a0e16c172

SHA512
451ffc5cd86fa7c50e6aa03151f0d0c611dc2e9fe7586700ddf63dd9fedd3d23b3c4301546ae27890cb2ef35598eb38a4c7de204ae44a1ffdf1d2d1414867ec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17407.exe

Filesize
468KB

MD5
deb3af32b6839d1e1dc25967387a0bed

SHA1
08665786f251735044fea9220bfc2bc471783926

SHA256
ce562078eb18add99618c33d1ff96ec31ba3c5a01b54a709c7c3c64bf32269df

SHA512
0579241de8c57623dda99eb639b96e606a72c20579e2443824806ebe2b9fa80d6cabfd416374ce096e605c8e3bc72653b538903b9d45256ed05ae15048f01c11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe

Filesize
468KB

MD5
2a91dfa88935001d25b0c7bd8b2e9641

SHA1
c6d58f8a175ec781203e05b620e7d14ff8478537

SHA256
b7f394c0a79b93f33965754d76fca397d08bd695c54b66827538eb8dc0886213

SHA512
e702750c64d5e9e46929b8297b30073e09937d6a603b7cc2f1819da6df1bded38944f1cab3104af3abec3e87884b36f00b254655931b8aeba7b92a4fe6380b3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18662.exe

Filesize
468KB

MD5
a82c3859e81f95de2808c9742e9a96ff

SHA1
c28572213c7bccb99b9be62a4ad18a51620ab339

SHA256
29de8c795c5dffb9901419c72d67a457e6fa4715851b758870f838bf40107f9c

SHA512
247b3a50cb2a81600a01d2588b0550c132294abe2c7e9b067049095d0d7abccdbf279e558618ba70a94fbe8f36584e585e01764aa3c5812f068b183a3642675e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe

Filesize
468KB

MD5
da1fbf041e3cea7d8468d10f6ec63fb6

SHA1
b969724f92466e7b406fc2c849dc43de006468aa

SHA256
4c94339ca01b6af9ef502dae2e62ccd2d254132b2ff5840a340cccbf2f7c20b7

SHA512
9fcdcedec2186c875d368214657e677005d22fde0dd749223092fc85b2f9f1efe849a54ee69a0c11e06eac4a516d95f0c6b25c85e9d3d094a0830dc2599a8b6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21897.exe

Filesize
468KB

MD5
b43cf63b92ae8c7a6cddc012dc9f9179

SHA1
f530056cbd4d4c27056aaa4d20eecb7bfa80492a

SHA256
945d3570d6cc3d84d27c12b7023a3058d07f35e454f248582042919f5fc6e466

SHA512
9f845a094572d4cd3a3d46858f6187df09d60e046e939060a07ecbf735657260951c1d833e8b8b66bda652ce988a2e16e8131ebb61e73a82170528e08303fdda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe

Filesize
468KB

MD5
6057581bdc59479875f6a91bf2124382

SHA1
9ab4331c6ce34152c4edf8b39ca2288cdc341b19

SHA256
ea50f0619a2fece1d669ad790c3bdb9094db00e20594a06d932dcaf8f0b00144

SHA512
5d30931ae24fbb1b6ad16ba1eff077ac16bbdb17229f3365b3e0697557d83f8326989cc5c830f10aa2482025d791ee132be1276614999008f2b746ad0125b325

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24498.exe

Filesize
468KB

MD5
73703a84844a97eff54736b7f682ae8a

SHA1
717d94c8a8b6d989c6a7657ea1ee5c0ea5e1a292

SHA256
3761765860f91fcd7701e1c76a2b41a04df319d31089fb0317937483f9f20fbb

SHA512
115b8e72f2c65564a7f7ca2d22f1b2289a183d3e81af98ed03c03a3d768db9577f5ee1c4b598c9c1c9282ee432d3000bf28f804e52f24f31db9698d78f5de182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe

Filesize
468KB

MD5
76840a21b2b25f7f01651e8967af6fa6

SHA1
5383267de03ae4f32f0995f71348e5a22b2d5a4b

SHA256
94afcae385c5b8fb08ab56b7c5f016222ea4fde5fd93485b6b3c6f8b430968fa

SHA512
8c1091f1a193c727195799a6a46b22e61b6017ef2586c4accfda7d5f3ba3a4730e5423d15c3eb27bcfeadd4eee581c60803af3155fc1fa9c51dee97509378061

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe

Filesize
468KB

MD5
0f69c36acac1c58a4bc15a70893c43e8

SHA1
de5a2e45b438b35185ae660e9aa5da8bf022d1ca

SHA256
f3548d4954f93d9c85936f89bbd0f13b6579524b8f73b33675a782749d970c5e

SHA512
7c300cc3be91ad72ca035176c45dfd966e9f5fdf8a3ab776ec1f911b106b458b3ac04bfcff69e746acfaa10e380b4ff8a1e1bedbf98eec019322cb948d4dbe52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe

Filesize
468KB

MD5
38b668106c196e1094ba111328cbf32d

SHA1
f36e0f219944a84766e24265b82c5f5fb320a56e

SHA256
a50a5e82815d2057f15183cfa4fd973a2cf80389671317cd3ca172fec539b9e4

SHA512
b5e3512b08e5e835d65ba4d559fb424ebb705551bc18971627ec823083e118351eabc4ee6733696f36bce462a2c1de33e6cc182fa8e392c07ecedb5cdf0ef4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe

Filesize
468KB

MD5
4414059109fa19a21bd50331ee9be18f

SHA1
2120ed71afe15ed7ed9c5f2036eef1b45d59431e

SHA256
64f3deb5a65efd959290a659dafe6a96ac232164d350c8fc6bcb1a2321bf4a93

SHA512
27dfcb997f413563d9e273d40ef44383c216187bd0461829df1c1c244ce9e7fa82540d76dc4ab6b6b007186764f772dc73e2ba9a9e23faa805610dd5011e0551

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31513.exe

Filesize
468KB

MD5
6e17305f36103dc44e5725d0aeeef7b9

SHA1
781b2f01e30e2c81786766e5fa0e929180454aaf

SHA256
3a1be923f7ff2a72454d9c8e1429231ec7cde363f5205c5cd2e5def82f7a4013

SHA512
69b15d37503bc3a2b58047a707b8f293a88ebb3fbfed95e3650f16644e9e3eabf8b922092a2b2b5c5992a206cbb4378def51e256140acab7525d003355632578

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32961.exe

Filesize
468KB

MD5
87901196a50e0582d847057ccb578f95

SHA1
c2604ec60b779cf56a54ded32a5c6b1d1f068d62

SHA256
96cf5ba37bd5831e32234f2a79db6307b60e16734561e90e38d03462454887e0

SHA512
0e6e65e5cd500b27806311c05048fcf7258e3f6e6682d66bf3240843a0b8700f811eafb6935de78be35baff5e09ae84c4315075d3f46a9f81fdc686486dcf4a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe

Filesize
468KB

MD5
6e6437dc34f451aa62c08f6956e3003b

SHA1
cf0b5b10637a0b871ed57878ce66d12f2b150f55

SHA256
791bc7cd6af5de9cc74e7cba5ab4f878811d30ba5e3fcced202506fc0da3a03c

SHA512
8edb788a50c27597c8a8473a06e45d8d06fd5ec51c8b838294263b9d40d8294855090f3d07ea36febb962d68e4a433d410b96ca9243c359c3dd8f9c3c18f0da0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3671.exe

Filesize
468KB

MD5
bdfde6b9cdb69b461964c7ead4dc5ff1

SHA1
bd57a4da1a01933b10604de0184756ef66fcf5ee

SHA256
2581f1aef968ed58652b2dedb661415748fb40814bdbb351fda0fc195e09f365

SHA512
8cc9cf3c1eaf8fd381aa71b2e08287105baa5929df8597cc3ef7c62493e11daa7f8f7aa2a1ac64b2833faeaa4eba9c9fc13f6e6cb776ad92e0df31da681e4ce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe

Filesize
468KB

MD5
aa58c7d0a5e4ea50089f06a751e5b4b7

SHA1
50a9bedcd2ea915fa02c5782c45f5762c15f242f

SHA256
d420d7528598550f1ce30f72dbe38a6ffa7fd9bc2d35cc3d670ca850797cdb15

SHA512
d9c43955f5c348c328b240fc3ba0fd4e5dbdced8d05d84752989368696e3ac8f03d3513f3d6e93e83416f8cc62ed9fe771d52eb9afb81e411ce18a0c8cf15bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe

Filesize
468KB

MD5
dc0dcaca959073c64729756779367860

SHA1
250a9e90ce9cd4a63ec5ff8a380c53c16c261843

SHA256
acc07b3fd201dc9e00885961be3058692cc85c5ce17da208c28c2df03338cbab

SHA512
fd58c757c331777cc04efbf86593d460eb5ec6c42bd35d07ef766bc16f6fb464308f8e039067b8a58018b20604e4fabf22199b0b3ef81b93f33dc05ff602e60b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44364.exe

Filesize
468KB

MD5
94d3779f3a92492b158fe4c3b2f2f4d5

SHA1
d6fc06f45290376c0af39dbcbf267f1d52aa4d42

SHA256
c9fbbc4577f6bb29ead778644789f640bf4cfc54e3085747a810235232e31846

SHA512
7dc6fbd69fde2d20ba6a5e2a8c93f93dd32f6ad116676e52b030fc9cf3f9310616edcb4442c70316dbaba3eb58898a24ec2e3d521eb0cb0302013fef48144496

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe

Filesize
468KB

MD5
153099a1955fdbfa057cc8a203a31cae

SHA1
eae80c52b76c226a4d02da8b791dd20e435ef397

SHA256
28b8ec77ed8229e28f5cbc1d7e9f0de3bd2e1a5e00fab774f71b6b2cd0ea5727

SHA512
5122dd78c786765fd87d686ffebb900c3132358ce86b92c04df31deefa5cf99fa12372ddae9eb606f577f2c03ffc14af962715d50168fdbcab73aa92ad9d56d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe

Filesize
468KB

MD5
212a2e41c0b20e4b00787f2274c6ec65

SHA1
ea69c74e5b4e871d57103b42b6b00f50c5e94dc7

SHA256
1db3a862f52941c7bfc4af820c4d5df19988e60a4c5a00d04dee3f6e1bb0c3fb

SHA512
4673dcfcf066513913fce288849a524250fb9d8cc513d352023b21cdb27bf59ebde02760a32340ad6ec980dc3ff621d324da292b2765034d3c5143bb639455bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49961.exe

Filesize
468KB

MD5
ed2f36f5580243a3f60409b4fe637d99

SHA1
58cd5cea93c47d241c63c7f512bc66e5a25d7c27

SHA256
8deea2f032555644328eecbc4788b81a6ca8346ef7fea413815c082b7588e882

SHA512
072e4e88157e519544da0cb2c603c2a45686369e53fcf58dc8e03afac28be7a5d1f4d821f26b084dfbc09eb9d8f8d1bc595590313d9f77ce28259d890e7c21ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50079.exe

Filesize
468KB

MD5
d6b81f061cb80db206be0ae689aa6c17

SHA1
9074f014d98fe02b834866108e1716119c2f40c1

SHA256
d41c13dec74a1fd8ec810d8b3c376592ec4475e9175d3d978cbb4d3eb08ef0c6

SHA512
0f4ea18cca02c7762bbce17e0f08f20883b8227a9381453fafd690744b55aabc8caeb5d806e44b87b585b6abd0cb355d568b0907dc26e5b6d403297eec0dda34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51660.exe

Filesize
468KB

MD5
ba7433a7accbe4cec7d940e763583b91

SHA1
a9b466c9dc80388a7fe0f13844779cf782711eee

SHA256
60c6c15e47a6d03eb6b95fdd1564953ce4b6b0534658dae06c4b74a364e6a583

SHA512
31d4a6095138c45370d21bc6538f1520d95065fae7856a43d2e29593d6c77c0de6ce6ee51608cb038f66355650ead981293e3bb21598612505bfec134af53d6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51987.exe

Filesize
468KB

MD5
b0b4f119ff154988d3ffc238326bfe4d

SHA1
e253f88d0d31c4f4a61198c41cb776602e52805d

SHA256
aa5f2616496bd8b75b4d98982911ad93b16333cdd1f883965babe382159b4750

SHA512
0e2989838b59433e2d36b240aecde83a28469367e62e9500c3a19c51f0cc3d71f17a074d5c7f84e649c8e7046b64010256ac6fea34106e74687a33b9257b51d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe

Filesize
468KB

MD5
b4911dac2505446a29120fe8a5eaa8ce

SHA1
23be3797e232677612de0ba3f2b9b948c82f71e4

SHA256
4303c0a2fd7c09a1b110458d3139c57145fc6b36182444bdd530c73b9ce5041b

SHA512
d45a0fcc4189a472b1fb962f63bdeabb72da8e85642e080bae6da8b21a34422f4ec571b43f50d3b831a5345a9e5300f419ddbf7a3bbf2e24885936859f801cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6050.exe

Filesize
468KB

MD5
804556f34af8eab13441cd2bbff67596

SHA1
c7c731803856464d4fed00c6730ffc70604e0b90

SHA256
439d5e63611d42ee7818ffc66107a9201e794aeabe7948d9d28a0b28ac5afbfb

SHA512
3fd1f27f0c108a19946bf50d50fd5b9a436668b694bf207b07ab760a88a2c15c31170fda7b63fdb7f1f276aca0b975fab3828ac17e94d93ac5bc9ddcbe6eaa23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe

Filesize
468KB

MD5
fe1b2d8e31804959ac2a4a591b719363

SHA1
3caf79fc74390e0b0fb9d485bf38c194be353638

SHA256
4701c162939780558e8b109e1506b8c58773bbe5ed6c5c6aaf3ef1369c0f15ef

SHA512
9c73a895c22ce3124531f7d7d30177a0a076f29f63e36c30246dbdeb6ba41a51610dcc333b991ffe0983520a5568ac654093421278baf254baa7d5c185d0019f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe

Filesize
468KB

MD5
22e4d077046240e7c53c00813720a389

SHA1
b9706db39e24acabe281ac9aa1addf70de3023b3

SHA256
a45be7e034db33d34dd2fedf122f27fabf8242db31c86ff6d3af38cd468508cf

SHA512
8a687c96babd5958cc6ca95baf4300885edf2dadab760b2fb643ccedc0a5ce3bf4274cadb78fecfefc715487b97108b7bf8869a332dab64c594f8c5f53a69cc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe

Filesize
468KB

MD5
d3b396125dc6b90c2520699ed73777c5

SHA1
d4a59f7869ab2039a6948e5b21e3f74aade85771

SHA256
f8b985dd14eff2c25f109e4b78264a56cfe8a0f5862dbbac795a2c755e34cfe7

SHA512
de3bd8a34b76ad24b16f1a7a3bc20f6e30fa6ad6c2bbc4be46ba4e857b5789172fa04200fc168032bcf36150a42a6f7162e1ba1ebd1e7149d09f0c205442be3f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads