996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48a

Analysis

max time kernel
107s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe
Size

468KB
MD5

a5ffeabb1c9720f5c34c29a25045b1b0
SHA1

ad6ce8b15a87320334eff1b078a28be2bf523e8f
SHA256

996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48a
SHA512

dacf4bd3375ac79b8f1549cf1418f78f9927b64857bd4a12dc8d2b5bdd191df22b4c215c1cde089a91f4ec40dab0e23f36becb451e48919df55ce156da64cc26
SSDEEP

3072:lGN7ogIKW05DtbYJHzcOcfr/9Chzw0p0nLHeapP9XPuLTqhg/clP:lG5op8DtOH4OcfLYVkXPQehg/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2156	Unicorn-32216.exe
516	Unicorn-39350.exe
1452	Unicorn-59216.exe
3212	Unicorn-60703.exe
2120	Unicorn-65342.exe
2312	Unicorn-36967.exe
4540	Unicorn-30836.exe
4960	Unicorn-42971.exe
5036	Unicorn-42971.exe
820	Unicorn-42971.exe
1288	Unicorn-42971.exe
3960	Unicorn-50874.exe
4020	Unicorn-31273.exe
3128	Unicorn-45009.exe
3132	Unicorn-31273.exe
3596	Unicorn-54943.exe
4624	Unicorn-13910.exe
1772	Unicorn-13910.exe
2924	Unicorn-46007.exe
3328	Unicorn-22057.exe
4216	Unicorn-22057.exe
816	Unicorn-22057.exe
4220	Unicorn-41923.exe
3632	Unicorn-41923.exe
2596	Unicorn-41923.exe
5096	Unicorn-58186.exe
4440	Unicorn-60489.exe
888	Unicorn-38585.exe
1396	Unicorn-49521.exe
4184	Unicorn-52321.exe
4024	Unicorn-61886.exe
4600	Unicorn-58015.exe
1672	Unicorn-58015.exe
3936	Unicorn-29213.exe
4360	Unicorn-49826.exe
3332	Unicorn-53355.exe
2292	Unicorn-60754.exe
4640	Unicorn-62867.exe
4444	Unicorn-28664.exe
3576	Unicorn-25343.exe
4012	Unicorn-49847.exe
1460	Unicorn-52077.exe
324	Unicorn-58207.exe
2164	Unicorn-17175.exe
2220	Unicorn-11044.exe
2140	Unicorn-37787.exe
3524	Unicorn-29619.exe
4848	Unicorn-54123.exe
3676	Unicorn-41871.exe
2152	Unicorn-42617.exe
1060	Unicorn-62218.exe
3700	Unicorn-38533.exe
4744	Unicorn-63038.exe
1080	Unicorn-56353.exe
4712	Unicorn-62483.exe
2684	Unicorn-3068.exe
2340	Unicorn-8933.exe
4208	Unicorn-54870.exe
3008	Unicorn-46531.exe
4288	Unicorn-56929.exe
4140	Unicorn-44331.exe
2248	Unicorn-15743.exe
3164	Unicorn-32079.exe
4468	Unicorn-28741.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
8140	4536	WerFault.exe	181
8896	4536	WerFault.exe	181
9156	6064	WerFault.exe	237
10016	6000	WerFault.exe	394
16596	14972	WerFault.exe	754
16624	15016	WerFault.exe	742

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22811.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4432	dwm.exe
Token: SeChangeNotifyPrivilege	4432	dwm.exe
Token: 33	4432	dwm.exe
Token: SeIncBasePriorityPrivilege	4432	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
64	996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe
2156	Unicorn-32216.exe
516	Unicorn-39350.exe
1452	Unicorn-59216.exe
2120	Unicorn-65342.exe
3212	Unicorn-60703.exe
4540	Unicorn-30836.exe
2312	Unicorn-36967.exe
4960	Unicorn-42971.exe
1288	Unicorn-42971.exe
5036	Unicorn-42971.exe
820	Unicorn-42971.exe
4020	Unicorn-31273.exe
3960	Unicorn-50874.exe
3128	Unicorn-45009.exe
3132	Unicorn-31273.exe
3596	Unicorn-54943.exe
4624	Unicorn-13910.exe
1396	Unicorn-49521.exe
888	Unicorn-38585.exe
4220	Unicorn-41923.exe
3328	Unicorn-22057.exe
4440	Unicorn-60489.exe
5096	Unicorn-58186.exe
4184	Unicorn-52321.exe
816	Unicorn-22057.exe
4216	Unicorn-22057.exe
1772	Unicorn-13910.exe
2596	Unicorn-41923.exe
3632	Unicorn-41923.exe
2924	Unicorn-46007.exe
4024	Unicorn-61886.exe
1672	Unicorn-58015.exe
4600	Unicorn-58015.exe
3936	Unicorn-29213.exe
4360	Unicorn-49826.exe
3332	Unicorn-53355.exe
2292	Unicorn-60754.exe
4640	Unicorn-62867.exe
4444	Unicorn-28664.exe
3576	Unicorn-25343.exe
4012	Unicorn-49847.exe
324	Unicorn-58207.exe
1460	Unicorn-52077.exe
2164	Unicorn-17175.exe
2140	Unicorn-37787.exe
4848	Unicorn-54123.exe
2220	Unicorn-11044.exe
3676	Unicorn-41871.exe
4744	Unicorn-63038.exe
1060	Unicorn-62218.exe
3700	Unicorn-38533.exe
2152	Unicorn-42617.exe
2684	Unicorn-3068.exe
1080	Unicorn-56353.exe
4712	Unicorn-62483.exe
2340	Unicorn-8933.exe
4208	Unicorn-54870.exe
3008	Unicorn-46531.exe
4288	Unicorn-56929.exe
4140	Unicorn-44331.exe
2248	Unicorn-15743.exe
3164	Unicorn-32079.exe
4468	Unicorn-28741.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 2156	64	996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe	82
PID 64 wrote to memory of 2156	64	996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe	82
PID 64 wrote to memory of 2156	64	996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe	82
PID 64 wrote to memory of 516	64	996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe	85
PID 64 wrote to memory of 516	64	996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe	85
PID 64 wrote to memory of 516	64	996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe	85
PID 2156 wrote to memory of 1452	2156	Unicorn-32216.exe	86
PID 2156 wrote to memory of 1452	2156	Unicorn-32216.exe	86
PID 2156 wrote to memory of 1452	2156	Unicorn-32216.exe	86
PID 1452 wrote to memory of 3212	1452	Unicorn-59216.exe	89
PID 1452 wrote to memory of 3212	1452	Unicorn-59216.exe	89
PID 1452 wrote to memory of 3212	1452	Unicorn-59216.exe	89
PID 2156 wrote to memory of 2120	2156	Unicorn-32216.exe	90
PID 2156 wrote to memory of 2120	2156	Unicorn-32216.exe	90
PID 2156 wrote to memory of 2120	2156	Unicorn-32216.exe	90
PID 516 wrote to memory of 2312	516	Unicorn-39350.exe	91
PID 516 wrote to memory of 2312	516	Unicorn-39350.exe	91
PID 516 wrote to memory of 2312	516	Unicorn-39350.exe	91
PID 64 wrote to memory of 4540	64	996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe	92
PID 64 wrote to memory of 4540	64	996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe	92
PID 64 wrote to memory of 4540	64	996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe	92
PID 2312 wrote to memory of 4960	2312	Unicorn-36967.exe	96
PID 2312 wrote to memory of 4960	2312	Unicorn-36967.exe	96
PID 2312 wrote to memory of 4960	2312	Unicorn-36967.exe	96
PID 2120 wrote to memory of 5036	2120	Unicorn-65342.exe	97
PID 2120 wrote to memory of 5036	2120	Unicorn-65342.exe	97
PID 2120 wrote to memory of 5036	2120	Unicorn-65342.exe	97
PID 4540 wrote to memory of 820	4540	Unicorn-30836.exe	98
PID 4540 wrote to memory of 820	4540	Unicorn-30836.exe	98
PID 4540 wrote to memory of 820	4540	Unicorn-30836.exe	98
PID 3212 wrote to memory of 1288	3212	Unicorn-60703.exe	99
PID 3212 wrote to memory of 1288	3212	Unicorn-60703.exe	99
PID 3212 wrote to memory of 1288	3212	Unicorn-60703.exe	99
PID 64 wrote to memory of 3960	64	996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe	100
PID 64 wrote to memory of 3960	64	996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe	100
PID 64 wrote to memory of 3960	64	996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe	100
PID 1452 wrote to memory of 3132	1452	Unicorn-59216.exe	103
PID 516 wrote to memory of 4020	516	Unicorn-39350.exe	101
PID 516 wrote to memory of 4020	516	Unicorn-39350.exe	101
PID 516 wrote to memory of 4020	516	Unicorn-39350.exe	101
PID 1452 wrote to memory of 3132	1452	Unicorn-59216.exe	103
PID 1452 wrote to memory of 3132	1452	Unicorn-59216.exe	103
PID 2156 wrote to memory of 3128	2156	Unicorn-32216.exe	102
PID 2156 wrote to memory of 3128	2156	Unicorn-32216.exe	102
PID 2156 wrote to memory of 3128	2156	Unicorn-32216.exe	102
PID 4020 wrote to memory of 3596	4020	Unicorn-31273.exe	104
PID 4020 wrote to memory of 3596	4020	Unicorn-31273.exe	104
PID 4020 wrote to memory of 3596	4020	Unicorn-31273.exe	104
PID 820 wrote to memory of 4624	820	Unicorn-42971.exe	105
PID 820 wrote to memory of 4624	820	Unicorn-42971.exe	105
PID 820 wrote to memory of 4624	820	Unicorn-42971.exe	105
PID 5036 wrote to memory of 1772	5036	Unicorn-42971.exe	106
PID 5036 wrote to memory of 1772	5036	Unicorn-42971.exe	106
PID 5036 wrote to memory of 1772	5036	Unicorn-42971.exe	106
PID 3960 wrote to memory of 2924	3960	Unicorn-50874.exe	107
PID 3960 wrote to memory of 2924	3960	Unicorn-50874.exe	107
PID 3960 wrote to memory of 2924	3960	Unicorn-50874.exe	107
PID 3212 wrote to memory of 816	3212	Unicorn-60703.exe	108
PID 3212 wrote to memory of 816	3212	Unicorn-60703.exe	108
PID 3212 wrote to memory of 816	3212	Unicorn-60703.exe	108
PID 4540 wrote to memory of 4216	4540	Unicorn-30836.exe	109
PID 4540 wrote to memory of 4216	4540	Unicorn-30836.exe	109
PID 4540 wrote to memory of 4216	4540	Unicorn-30836.exe	109
PID 2120 wrote to memory of 3328	2120	Unicorn-65342.exe	110

C:\Users\Admin\AppData\Local\Temp\996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe
"C:\Users\Admin\AppData\Local\Temp\996feb967b4e1e29461ef8ff02024017a9d0e9686c7d52706f402430654ed48aN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:64
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32216.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32216.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61886.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11777.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11970.exe
        9⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15265.exe
        9⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22548.exe
        9⤵
        
        PID:18280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64973.exe
        8⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15981.exe
        8⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34368.exe
        8⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        8⤵
        
        PID:18004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        8⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        9⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        9⤵
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40921.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39909.exe
        8⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
        7⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4192.exe
        7⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        7⤵
        
        PID:16212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56929.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49759.exe
        7⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31991.exe
        9⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        9⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        9⤵
        
        PID:16488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
        9⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        8⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63541.exe
        8⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6285.exe
        8⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        8⤵
        
        PID:18244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57331.exe
        8⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26602.exe
        8⤵
        
        PID:17728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        7⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        7⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24259.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40921.exe
        7⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
        7⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14117.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29419.exe
        6⤵
        
        PID:12028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5392.exe
        6⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18602.exe
        6⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22057.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32633.exe
        6⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        8⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
        9⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49150.exe
        9⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39378.exe
        9⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7953.exe
        8⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20500.exe
        8⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8102.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8285.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25144.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
        7⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        7⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exe
        7⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13381.exe
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56465.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        6⤵
        
        PID:16804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45468.exe
        6⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29147.exe
        6⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 548
        7⤵
        Program crash
        
        PID:8140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 636
        7⤵
        Program crash
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32249.exe
        6⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31187.exe
        7⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        7⤵
        
        PID:16812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
        6⤵
        
        PID:15152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        6⤵
        
        PID:18268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61938.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        7⤵
        
        PID:17112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
        7⤵
        
        PID:17992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45286.exe
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        6⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        6⤵
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9552.exe
        5⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        6⤵
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        5⤵
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
        5⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        5⤵
        
        PID:18196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54123.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54035.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2582.exe
        8⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27295.exe
        9⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        9⤵
        
        PID:17072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26248.exe
        9⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39089.exe
        8⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63541.exe
        8⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6285.exe
        8⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        8⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        8⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        8⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
        7⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
        7⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        7⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        7⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        7⤵
        
        PID:17604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe
        6⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        6⤵
        
        PID:16724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4435.exe
        6⤵
        
        PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        6⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        8⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        8⤵
        
        PID:17144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39665.exe
        7⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30484.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
        7⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
        6⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        7⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32429.exe
        7⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56181.exe
        7⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        6⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        6⤵
        
        PID:15228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15040.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        6⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50647.exe
        7⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        7⤵
        
        PID:16796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe
        7⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42921.exe
        6⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15766.exe
        6⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        5⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        6⤵
        
        PID:17828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43969.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33645.exe
        5⤵
        
        PID:12104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37787.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11777.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        7⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22892.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe
        7⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62899.exe
        7⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        7⤵
        
        PID:16964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15981.exe
        6⤵
        
        PID:11800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34368.exe
        6⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        6⤵
        
        PID:17812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3646.exe
        6⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30803.exe
        7⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        7⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
        7⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3344.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        6⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe
        5⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7316.exe
        5⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        5⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53444.exe
        5⤵
        
        PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62218.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53843.exe
        5⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        7⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40921.exe
        7⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60350.exe
        7⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14673.exe
        6⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
        6⤵
        
        PID:12528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        6⤵
        
        PID:17212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        6⤵
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        6⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        5⤵
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        5⤵
        
        PID:16756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        5⤵
        
        PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
      4⤵
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        6⤵
        
        PID:17120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        6⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
        5⤵
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        5⤵
        
        PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58554.exe
      4⤵
      PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12451.exe
        5⤵
        
        PID:17596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10436.exe
      4⤵
      PID:10044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28069.exe
      4⤵
      PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55090.exe
      4⤵
      PID:8660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13910.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41871.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        8⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9645.exe
        8⤵
        
        PID:15016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15016 -s 472
        9⤵
        Program crash
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58874.exe
        8⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        7⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-545.exe
        7⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64772.exe
        7⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
        7⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        8⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        8⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
        8⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14096.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32064.exe
        7⤵
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34744.exe
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        6⤵
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        6⤵
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59622.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        6⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9406.exe
        7⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        8⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        8⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        8⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        7⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
        7⤵
        
        PID:16464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32685.exe
        7⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        6⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51991.exe
        7⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6145.exe
        7⤵
        
        PID:16780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58846.exe
        6⤵
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        6⤵
        
        PID:17848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56073.exe
        5⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9406.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51731.exe
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
        8⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5781.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
        7⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34096.exe
        7⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21881.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63785.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
        6⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23698.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        6⤵
        
        PID:16884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40338.exe
        6⤵
        
        PID:17900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19272.exe
        5⤵
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29561.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43823.exe
        5⤵
        
        PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22057.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17175.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
        6⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        8⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39186.exe
        8⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29421.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        7⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30022.exe
        7⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        7⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        6⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        7⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3397.exe
        7⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        7⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        6⤵
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        6⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        5⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57315.exe
        7⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18411.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14972 -s 464
        9⤵
        Program crash
        
        PID:16596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52778.exe
        8⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        7⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14673.exe
        6⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10116.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34866.exe
        6⤵
        
        PID:16040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23448.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25232.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        6⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8913.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11540.exe
        5⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19310.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        6⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        7⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        7⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29630.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
        6⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31916.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28618.exe
        5⤵
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30034.exe
      4⤵
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14642.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61067.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39245.exe
        6⤵
        
        PID:12944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52097.exe
        6⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1949.exe
        5⤵
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        5⤵
        
        PID:13708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43822.exe
        5⤵
        
        PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16184.exe
      4⤵
      PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        5⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
        5⤵
        
        PID:15436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
        5⤵
        
        PID:17668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
      4⤵
      PID:9404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
      4⤵
      PID:12336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22676.exe
      4⤵
      PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45009.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        6⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        7⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        8⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40921.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36846.exe
        8⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
        8⤵
        
        PID:17612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
        8⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
        8⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
        7⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34866.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34725.exe
        7⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        6⤵
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        6⤵
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        6⤵
        
        PID:17588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30085.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        7⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        7⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45861.exe
        6⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
        6⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        6⤵
        
        PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18984.exe
        5⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        6⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6521.exe
        6⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15641.exe
        6⤵
        
        PID:17692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        5⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exe
        5⤵
        
        PID:13488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
      4⤵
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        5⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        6⤵
        
        PID:14360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        6⤵
        
        PID:17764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14568.exe
        5⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
      4⤵
      PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30100.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4716.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
      4⤵
      PID:13744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
      4⤵
      PID:7676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62867.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        5⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
        7⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        7⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53878.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51238.exe
        6⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exe
        7⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20634.exe
        7⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        6⤵
        
        PID:17012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1601.exe
        5⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        6⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64627.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        7⤵
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        6⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        6⤵
        
        PID:16692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45243.exe
        6⤵
        
        PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        5⤵
        
        PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15353.exe
        5⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25632.exe
        5⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15465.exe
        5⤵
        
        PID:18216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
      4⤵
      PID:692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36703.exe
        6⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
        7⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32357.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        6⤵
        
        PID:14848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8486.exe
        6⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60261.exe
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60470.exe
        5⤵
        
        PID:13180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
        5⤵
        
        PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65305.exe
      4⤵
      PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22229.exe
        5⤵
        
        PID:11468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
        5⤵
        
        PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
      4⤵
      PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56465.exe
      4⤵
      PID:13772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
      4⤵
      PID:16960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
      4⤵
      PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        6⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        6⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29421.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        5⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30022.exe
        5⤵
        
        PID:17048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36385.exe
        5⤵
        
        PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
      4⤵
      PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        5⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        5⤵
        
        PID:15468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
      4⤵
      PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
      4⤵
      PID:13876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
      4⤵
      PID:4872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24101.exe
    3⤵
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe
      4⤵
      PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        5⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        5⤵
        
        PID:12492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        5⤵
        
        PID:16676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
        5⤵
        
        PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
      4⤵
      PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13040.exe
      4⤵
      PID:13396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
      4⤵
      PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
    3⤵
    PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62359.exe
      4⤵
      PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
      4⤵
      PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
      4⤵
      PID:15760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
      4⤵
      PID:17876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14312.exe
    3⤵
    PID:8820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
    3⤵
    PID:12156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
    3⤵
    PID:14760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39350.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39350.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36967.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62203.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        8⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        9⤵
        
        PID:17136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53646.exe
        8⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        8⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
        8⤵
        
        PID:17640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        7⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13698.exe
        8⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe
        8⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-640.exe
        7⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
        7⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        7⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10433.exe
        6⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29895.exe
        8⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        8⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24631.exe
        7⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11776.exe
        6⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6298.exe
        7⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        7⤵
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5589.exe
        7⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45661.exe
        6⤵
        
        PID:14628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        6⤵
        
        PID:18040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        6⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        8⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        8⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        8⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64066.exe
        7⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19741.exe
        7⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
        7⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35233.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        7⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        7⤵
        
        PID:14948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7516.exe
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65130.exe
        6⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27292.exe
        5⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        6⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51799.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        7⤵
        
        PID:17228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33033.exe
        6⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        6⤵
        
        PID:13584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20245.exe
        6⤵
        
        PID:18116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51850.exe
        5⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61649.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14761.exe
        5⤵
        
        PID:15084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe
        6⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16651.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        8⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        8⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7562.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe
        7⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        7⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50818.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34298.exe
        7⤵
        
        PID:17328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2789.exe
        7⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        6⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
        6⤵
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47706.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36703.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        6⤵
        
        PID:14844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41159.exe
        6⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
        5⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        6⤵
        
        PID:17124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18765.exe
        6⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        5⤵
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-921.exe
        5⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12219.exe
        5⤵
        
        PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11044.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9110.exe
        5⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        6⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        7⤵
        
        PID:13624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        7⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58846.exe
        6⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36385.exe
        6⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58534.exe
        5⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        6⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        5⤵
        
        PID:10236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58846.exe
        5⤵
        
        PID:12828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20905.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
        5⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47331.exe
        6⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
        6⤵
        
        PID:17024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12613.exe
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        5⤵
        
        PID:13696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
      4⤵
      PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12201.exe
        5⤵
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
        5⤵
        
        PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61183.exe
      4⤵
      PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34191.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31187.exe
        9⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        9⤵
        
        PID:17004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52097.exe
        9⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37117.exe
        8⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        8⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30998.exe
        8⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19815.exe
        8⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26602.exe
        8⤵
        
        PID:17656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60173.exe
        7⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
        7⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48830.exe
        7⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36089.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60911.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62515.exe
        8⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
        8⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
        7⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17184.exe
        7⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        7⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62515.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        7⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14873.exe
        7⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        6⤵
        
        PID:15072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
        5⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        7⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
        7⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exe
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26122.exe
        6⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        6⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6244.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        6⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        7⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        7⤵
        
        PID:17304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57805.exe
        7⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56053.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56571.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13853.exe
        5⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60601.exe
        5⤵
        
        PID:11712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exe
        5⤵
        
        PID:16048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32079.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        8⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        8⤵
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
        8⤵
        
        PID:18292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53646.exe
        7⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16416.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28414.exe
        7⤵
        
        PID:18180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32249.exe
        6⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        7⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        7⤵
        
        PID:17236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46622.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54213.exe
        6⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64967.exe
        6⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33541.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7102.exe
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30589.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
        6⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12264.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32933.exe
        6⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25494.exe
        5⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exe
        5⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        5⤵
        
        PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62897.exe
      4⤵
      PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53599.exe
        5⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        6⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45566.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28180.exe
        5⤵
        
        PID:12776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28870.exe
        5⤵
        
        PID:16920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43350.exe
      4⤵
      PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3802.exe
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28093.exe
        5⤵
        
        PID:15920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
        5⤵
        
        PID:18052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
      4⤵
      PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
      4⤵
      PID:13792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
      4⤵
      PID:16912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26905.exe
      4⤵
      PID:1176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32633.exe
      4⤵
      PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4014.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57315.exe
        6⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
        6⤵
        
        PID:15068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64834.exe
        5⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        5⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62310.exe
        5⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
        5⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
      4⤵
      PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14082.exe
        5⤵
        
        PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50878.exe
        5⤵
        
        PID:16708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13804.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2552.exe
      4⤵
      PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9141.exe
      4⤵
      PID:13428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
      4⤵
      PID:3768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
      4⤵
      PID:392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
        6⤵
        
        PID:12956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
        6⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        5⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40967.exe
        5⤵
        
        PID:7292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63578.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        5⤵
        
        PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44413.exe
      4⤵
      PID:10292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
      4⤵
      PID:14976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64242.exe
      4⤵
      PID:7660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exe
    3⤵
    PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
      4⤵
      PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        5⤵
        
        PID:17556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39665.exe
      4⤵
      PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30484.exe
      4⤵
      PID:12628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
      4⤵
      PID:4284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13437.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25615.exe
    3⤵
    PID:10256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13910.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        8⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33033.exe
        8⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        8⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
        8⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26393.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60173.exe
        7⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
        7⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32301.exe
        7⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        8⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        8⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18765.exe
        8⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe
        7⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        7⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32114.exe
        7⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        6⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        6⤵
        
        PID:11412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exe
        6⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        6⤵
        
        PID:18060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46562.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3478.exe
        7⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        6⤵
        
        PID:12692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        6⤵
        
        PID:16788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15465.exe
        6⤵
        
        PID:18208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        5⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11994.exe
        6⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39318.exe
        5⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
        5⤵
        
        PID:12036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
        5⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
        5⤵
        
        PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3490.exe
        5⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11762.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        7⤵
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
        7⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
        6⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31187.exe
        7⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52097.exe
        7⤵
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15352.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
        6⤵
        
        PID:15584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
        6⤵
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51570.exe
        5⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55919.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58986.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62885.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
        6⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
        5⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        6⤵
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38994.exe
        6⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        5⤵
        
        PID:12660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exe
        5⤵
        
        PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
      4⤵
      PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60039.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27855.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61363.exe
        7⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3013.exe
        7⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        7⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
        6⤵
        
        PID:14100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15969.exe
        6⤵
        
        PID:18016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38113.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59213.exe
        5⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18197.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        5⤵
        
        PID:17680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
      4⤵
      PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19163.exe
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        5⤵
        
        PID:12484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        5⤵
        
        PID:16684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30652.exe
      4⤵
      PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12353.exe
      4⤵
      PID:11968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
      4⤵
      PID:16200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
      4⤵
      PID:5828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22057.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49375.exe
        5⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15619.exe
        7⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33270.exe
        7⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49317.exe
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        6⤵
        
        PID:12784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64626.exe
        6⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        6⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47362.exe
        6⤵
        
        PID:15456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48314.exe
        6⤵
        
        PID:17888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
        5⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
        5⤵
        
        PID:9648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
      4⤵
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24435.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        6⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        6⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe
        5⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35058.exe
        5⤵
        
        PID:16192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45514.exe
        5⤵
        
        PID:17564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
      4⤵
      PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-906.exe
        5⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        5⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        5⤵
        
        PID:16876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        5⤵
        
        PID:18140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
      4⤵
      PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
        5⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exe
        5⤵
        
        PID:18236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58245.exe
      4⤵
      PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7369.exe
      4⤵
      PID:788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
      4⤵
      PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
        6⤵
        
        PID:18024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10064.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        5⤵
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
        5⤵
        
        PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5249.exe
      4⤵
      PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4186.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        5⤵
        
        PID:16480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53878.exe
        5⤵
        
        PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59213.exe
      4⤵
      PID:9812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18197.exe
      4⤵
      PID:14328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
      4⤵
      PID:7644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
    3⤵
    PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11046.exe
        5⤵
        
        PID:11236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
        5⤵
        
        PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44859.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
      4⤵
      PID:8996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45861.exe
      4⤵
      PID:13440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
      4⤵
      PID:18032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1953.exe
    3⤵
    PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe
      4⤵
      PID:12004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15457.exe
      4⤵
      PID:16244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62179.exe
    3⤵
    PID:10444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10296.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46007.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
      4⤵
      Executes dropped EXE
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53054.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61959.exe
        5⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16017.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23328.exe
        6⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        6⤵
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
        6⤵
        
        PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
        5⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40049.exe
        5⤵
        
        PID:11408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19741.exe
        5⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
        5⤵
        
        PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29316.exe
      4⤵
      PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62515.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
        5⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
        5⤵
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8913.exe
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33645.exe
      4⤵
      PID:12732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe
      4⤵
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exe
        6⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24156.exe
        6⤵
        
        PID:17100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
        6⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45861.exe
        5⤵
        
        PID:13432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
        5⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        5⤵
        
        PID:18152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exe
      4⤵
      PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        5⤵
        
        PID:11152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
      4⤵
      PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20205.exe
      4⤵
      PID:14016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27360.exe
      4⤵
      PID:16900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
      4⤵
      PID:8728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
    3⤵
    PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
      4⤵
      PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        5⤵
        
        PID:12120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12201.exe
        5⤵
        
        PID:15132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
      4⤵
      PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64050.exe
      4⤵
      PID:6516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24850.exe
    3⤵
    PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36475.exe
      4⤵
      PID:11252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39577.exe
      4⤵
      PID:14776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
      4⤵
      PID:2316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
    3⤵
    PID:9016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58534.exe
    3⤵
    PID:13932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49521.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49521.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32271.exe
      4⤵
      PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60039.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6666.exe
        6⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        7⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
        7⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        7⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63541.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6285.exe
        6⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13417.exe
        5⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27103.exe
        6⤵
        
        PID:13076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        6⤵
        
        PID:17152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
        6⤵
        
        PID:17708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
        5⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        5⤵
        
        PID:15056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4569.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        5⤵
        
        PID:6000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 464
        6⤵
        Program crash
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        5⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23004.exe
        5⤵
        
        PID:16948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
      4⤵
      PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37554.exe
      4⤵
      PID:12020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
      4⤵
      PID:16236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
      4⤵
      PID:18224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53438.exe
    3⤵
    PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4398.exe
      4⤵
      PID:6064
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 636
        5⤵
        Program crash
        
        PID:9156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16977.exe
      4⤵
      PID:8308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
      4⤵
      PID:12928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30022.exe
      4⤵
      PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
      4⤵
      PID:8948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
    3⤵
    PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60055.exe
      4⤵
      PID:11068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
      4⤵
      PID:14752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27701.exe
      4⤵
      PID:7692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58690.exe
    3⤵
    PID:9288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
    3⤵
    PID:13840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
    3⤵
    PID:10812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
    3⤵
    PID:17864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48799.exe
    3⤵
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
      4⤵
      PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5182.exe
        5⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
        6⤵
        
        PID:14632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21269.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        5⤵
        
        PID:16868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34709.exe
      4⤵
      PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10116.exe
      4⤵
      PID:11792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
      4⤵
      PID:16072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
      4⤵
      PID:18260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50802.exe
    3⤵
    PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17435.exe
      4⤵
      PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
      4⤵
      PID:11304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe
      4⤵
      PID:15592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46203.exe
      4⤵
      PID:17716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9524.exe
    3⤵
    PID:8884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52493.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
    3⤵
    PID:7256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56735.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56735.exe
  2⤵
  PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
    3⤵
    PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49095.exe
      4⤵
      PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
      4⤵
      PID:12792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
      4⤵
      PID:16824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28414.exe
      4⤵
      PID:18128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
    3⤵
    PID:8428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
    3⤵
    PID:12812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17080.exe
    3⤵
    PID:16432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51791.exe
    3⤵
    PID:5864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12916.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12916.exe
  2⤵
  PID:6764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
    3⤵
    PID:11196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
    3⤵
    PID:15288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43917.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43917.exe
  2⤵
  PID:8284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
  2⤵
  PID:13732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40914.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40914.exe
  2⤵
  PID:16508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
  2⤵
  PID:5932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4536 -ip 4536
1⤵
PID:7700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4536 -ip 4536
1⤵
PID:7848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 6064 -ip 6064
1⤵
PID:8920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6000 -ip 6000
1⤵
PID:9640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 14972 -ip 14972
1⤵
PID:16832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 15016 -ip 15016
1⤵
PID:16644

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13910.exe

Filesize
468KB

MD5
80c00e0adbc1c352456317f4b970d506

SHA1
82316e48a2972c288a1fff1a2c569c95c339333e

SHA256
c9569761ab067675ebe6d6edb9da06a6721bd4416c3faac762a9e02d99e2ee33

SHA512
f6a61bd9a61ffe957652fd7b9ebb560071b7ecf4c76d7af5971dc6c673f8ebc3128ef60e37553c07f4d17e62876489321215a92a8187e4a629d3aae7b2bd68d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22057.exe

Filesize
468KB

MD5
bd6e03e4caed62691d49ef13c4276963

SHA1
b3ff1d6caaf96026c91b6d889673f978edde02ab

SHA256
cd96cf30a126e6ea14fc49384a8cfa45fb9cbe1f351c068258db71891d0f7fbc

SHA512
0b9664ed76473472ebb1338109873c6a5e4d0af6d4a2298baca5039ce70fa01038a343bab6975c70c9994dee5fcca18a5a99cc45e2e569f6048911f62b52dcdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe

Filesize
468KB

MD5
c449fe214e172fe6fbf800cf9d8c18da

SHA1
4e13a183f36157d000ac0bb73fb767d05ef26355

SHA256
e08e3b51cc6ba869884fb50df46c3fc9bff3f3f41a86c8bc49301eeaab183609

SHA512
bb200e28a632fe2d66a9fd59be86a8734e3c45b9c99d60f62087e559162ac0e3d45f9ee4cdb34c7e3504804fdc2afe7f9c65ca636942c68de218eae04b17d725

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe

Filesize
468KB

MD5
fd6385f1435e5864d8e0e9291bad2c74

SHA1
d62b9a60cb1c50a3e26aff47ab704344b56ca98b

SHA256
6b6d04429105fe1c93b4a834cc48d5194c50845e0a04eb39560c54f92bbde396

SHA512
6b45715f0c02e6500421adb96866b13595381f68ae9e6ba2b5f0a53d2d31d96e251e0cd85c0dcebb84b72ec357a7bdf664ee23953c718b8427982f10fa9c3ba9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe

Filesize
468KB

MD5
09007fa79fea7f09a54e4623801a1064

SHA1
56fd88be77b9e276d066e6b80c58325a3110c6fa

SHA256
91fc241d3bf1b3b967a402bf7922a9f47554fba050f5238badf0c54b9e12f757

SHA512
793c6285d042e41683f95d4de342cdfbb548008d6096c243b7e54034aa91f54daf566c1c8a0efca672c133b4b141ebffb6cfeb4cfc0d04382b1929b3b27e3530

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32216.exe

Filesize
468KB

MD5
fa0dc743668cd29dc655961c428698f7

SHA1
e2d56909aa25daeece7718bdbaccac7f4204b2e6

SHA256
bb6a2f8e26b9aa348ae9dd3dcc6aa26283ae67b73930dd35361a264d811f00a6

SHA512
37de470219f4939e583f82d180679aad631b35787f493212a940901fccb7747091fddcd4ff7db9d603766f3b721888eba139f112bdda474f528273d4f7de2d6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36967.exe

Filesize
468KB

MD5
e936fedf9d71078cea578aeba607a5a9

SHA1
0e8569c22e46e1e74a078a1e8764ec85bc90efcf

SHA256
2f9dce5cf18c08a73e7161ae648bf3242026f5eb63a5b60df4ad5af800f9bdeb

SHA512
1d0074a292c8c025e1917f246764a1ca982b9723c3e6ed12f79deb288845becfac48c80b3c3b21d6f49899465d0069ebbca55775f261dacda127635056150239

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe

Filesize
468KB

MD5
d46ba9fba4014596c64e2dadbcb16476

SHA1
df8d680b832249d2b90cb97e700903f688bdefea

SHA256
e17b9f52b04bc7ee0a19954ab53a32c0fb2f4dbbd874c2c1736ede86a2746e33

SHA512
3fa9f76417c4b763fb6ffe3b0844be63e5bf5ca81cb0b5f0a180f882a1afbb7dc4477ced04c457337f6fe0622a6ec4c05b646143b6b04a5f928a8a85dcb44223

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39350.exe

Filesize
468KB

MD5
23af8a49c92f3edd6915c5cc78f1ffad

SHA1
894b3b199266daa29e82714993657673abdac239

SHA256
83cb6efcdff7b9d21b11d6e96b984f9e7fcb497d436d0421095ee91ec5eef010

SHA512
379a18ad33159c02095bb29134bf4dbc4ec22f379d04e3a1fb573856751113ce050972abf7720525210796e0d71e17fdc8c8114bc58e578134ac4d09132caca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe

Filesize
468KB

MD5
46cb99068ded657d6e7c2d21cb0a957f

SHA1
c36656643c19e36db49e6a288a36ec6f90dd003c

SHA256
b93bc45d80cdfb1db1594abdee2cfe45686875c8f9beb0d02f5d6c4165cd70d1

SHA512
65a0ddf4ed7cf6363d9f4c857b75df1acf560c0fa33d71c678ba2314a8f0aa23e4e1116bbf46d9d836dde1982fca4f8368cd13f475ddb30734372228f09fc6c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe

Filesize
468KB

MD5
5ffb2b0f7c3fa5392c848841d36c0159

SHA1
1b982b7e6c73cfa62730674c5b77c87751f39790

SHA256
a81d9720cd524716fd91a7fe10924980b4edd22b49bd26318b1d0e3747c96165

SHA512
156c6c6ab00b93c6cad71ceac9d2451f87f14c38069d5503038c18b88fbc4fd91d0fb064df7a0fd2d662422879c14d2046445485f5aed15fcb30e14c55b70736

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45009.exe

Filesize
468KB

MD5
bb849e19eb301a54a608d40123455844

SHA1
7eea9cc4250a47a7b71c823b58e1564e9a15246d

SHA256
dc8b3a43aeaa8481617382fa36ef7990751d5da206db357cc75febee54ecce11

SHA512
e8876019a977fb0eaead4caefc9c6a41178d865bb00e07eb65b6ae33ff87131c7b4dbf011085497bf4a8cf2adad4dd331abb801813ee172366bbcf7f1abc3fe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46007.exe

Filesize
468KB

MD5
146d87ead8ad5b5c26805b8bfc4325af

SHA1
e8b41766b482fc9be6731b54e8367c8d9efddb0e

SHA256
04ab49ac3a8602005aa0bbcb6b3ebf1b654f7bc360e3072375eb03b0f9f01ed1

SHA512
45cddaf8ed8d11233a6d624944f2a5a7c3da47942a022f9ec8eb33232f2d77fd76cff14a98753c6d2362e059336eac6b4c63da3fe3625759820bf5802fb55f32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49521.exe

Filesize
468KB

MD5
dbedc6973de3e280c96bfa8549338c4c

SHA1
83408af76cf4ab16bba565640ad0cb298b2d9f0b

SHA256
65e258a7b2f328017f0578f28a233e2d091a5638f72cdfa6402481312ca3be30

SHA512
d101875441b8ff6a5902a6ccaa00e623a007c37e7829d3ca35aeefbd1b225b2b161a5edb6839da80f77ddee5ff06e87c41b1006f9f800f3af5e06e6dfe44fe5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe

Filesize
468KB

MD5
52669600973108be26ee6a4a6c47d4b2

SHA1
53ace9787585aeb1f25179918874217d77e8f01f

SHA256
835bca1a35bfe71564da1d901f3867110ae0424f603b1c24628cd9af51378c0a

SHA512
e7836421906fcb3bde740667cffd69e23a6eef5a562e15ce24e038cacd86da63d749d44f5f863d3115b6c91e84bdcc3570d8bf941df2e315280a86df32211c72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe

Filesize
468KB

MD5
ffe05cfe5453f2b7dee0f3a22f47aa18

SHA1
934331f6f5d96e4dbb3676e6be0932e677a688aa

SHA256
8c8b99ccd6dfdb9c00e635a5657069943fa146b5a327ce76116dc1ecea97c6ce

SHA512
5481d428e1366be291f0e27868c1ce5540ed8d07a8c5fff6d95d119ca394de288d457932943ae2be70996a19d7020bf79e7f97184bce2d0f3bee263d77529d14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe

Filesize
468KB

MD5
d2f4c7f4c7d406ce389097c5e2b2242b

SHA1
c4f111b99f3dca91c756c566586b286b9d9a1164

SHA256
7301e3f1849e5121f12fb5f35bda650bd6bcd99f6c226b4c7f2b371750fd40b7

SHA512
c9410bcf01ef3d6877dfec1c3ee497ebae11f2f7d4665789b878ce69605a8b6297d7b4806a5805715cae752d8c84d3c647a14279cedca54ab6aa30d3901271d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe

Filesize
468KB

MD5
8c88c8d1bf4523b17a8528dd1f1395c4

SHA1
b337b455167943c54d61602bc1c8367db8eb0725

SHA256
11ffe888395286aa5e57dfe734519cef9001e6ed671943a99bf6982cc1c6a5e7

SHA512
1c077b4f6041b0b73a094affcf1301594359054b0d867357288e3592a7bb4dd5a5428b3433fd9c53af4adc5cf1705d522726b22fe8aa05598065d8f34f41442f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe

Filesize
468KB

MD5
1388b6b54071bcd2a1c0fc3397e7df9b

SHA1
49e1f232b3e284261a3ddbd9632c64992e7bfcf1

SHA256
4b1e54440eda0b37546b7c4314f6e16669d7a32d21440be2d285e85cbe9001b2

SHA512
882606793be676ef0b534951d6e06e17294d56720c794a3f210d91c4854de329b2fca0102829f72115f19b14982ce6930b4c38c49e1f202dac24f298ced18611

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5589.exe

Filesize
468KB

MD5
a129857bcdbffc01c7954f769fba13c4

SHA1
61e855a93e783c14ac8dd5dd76bbfb2eed74e7c0

SHA256
580ddf751e96803a5a5e08031ca41f851c616c88140d7bc01d1be4ba76085812

SHA512
b76ad2f66e5013fe2e41bfb2edd7b8f7e34a90148ed2731ee8f14d25479842aa685cf5c811ea58f58bcc538cc87a61aa6d20cdb83d72b16e3d4298415f4803c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe

Filesize
468KB

MD5
bbe4f17e4eb4e02d5ad8bcf033d4b516

SHA1
5ad0c38c85bb9f591173b420bb5bf138c618422f

SHA256
83a6e51a06b76126fe9c35d8026c71e7bbb28e414e60875b8e7a67c7370f1d10

SHA512
bda7ec27442d2dc1674dc3827c4f478cbdaa9342fa74b60c9ed3bd0e9c6533bf87e767c6479f4af369d7bec71dc32545c5cf0e9e2afa74c6d3c11df98af1ae2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe

Filesize
468KB

MD5
9a7c762d042904652391dff75d9ca9d7

SHA1
0f9456200cf63675926fd76dacf485d7c65934a1

SHA256
481e13be08168d9db4dba053a7ae4fca447275658be10df64362a9a5da98e633

SHA512
106387cb1548214877f90dc505a4d791c8f9bfeb35c7a11974ea00d90873b568b5207d6f5ccea18ff927f634950ed4341a3d98827ecf3d73c8bfb78e3bd4a37a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe

Filesize
468KB

MD5
59023e61b9b9fe64705800070e8649dd

SHA1
429e9c715b3fc4154d91322f0a711e306d492283

SHA256
e3e355ffbfc59be1a92662e0c82a9df6643b94e389af1bc7889d984da21a9f3e

SHA512
19cf5126d5b2b7265234865cc230f6138bb6e3bbe31c10fd4da184079b98c4a47a961b5914f6ba78ccd4f27570580b4b070cac4ad4e4e94eb5af01659afb2495

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe

Filesize
468KB

MD5
cce64cc7c114be64e1fc2b90fa155987

SHA1
ef54b065fafaf6de2845ebcd0abb2768a63c3c69

SHA256
9b10c99b67ba62ef4b00de8fd6dd82f9b22d6463c699edc5b81c6428e0062140

SHA512
be6450ffc41e14a54fc33cfee4bb6000eeb489a29839d949c38b2182010e0bc9edf72c43456a25409314be0844dbb166755be44839f606d4f200ae36bd5f19e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe

Filesize
468KB

MD5
68de67c1e015a179d27b27a9297f0f39

SHA1
e6c7e0e627672a1aad5aa7178a83a6a0419b1411

SHA256
ef8c47ecd862546b85cc492fbfa279495a03a9e8807cea19556a4c12b4bec906

SHA512
abe2fe7556e636242433f6fc603668683f350a2e333d14d72a103b4aaee3edfaa1321599f9860958fca73f462e8743a8b3a0de9180a7187bdf21cf6a0a88d471

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe

Filesize
468KB

MD5
a0305b0f52482c55abc3449cc7cab8c1

SHA1
e7ef0ec4ae458e5963d46ef3fe4b79b52f66aa8d

SHA256
3f5747abc944981798781a0b83c23a7d0f6e70b07f5919273755954dbc229079

SHA512
bf25573e06091f1222b3bd0529b06d225b466845f09f278ef7eeccea806d8b769ecef717408f0192db4b4cf2bdd9a1291a628e7fadb6d1e4a00ea6c306ab9246

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61886.exe

Filesize
468KB

MD5
b8f48ff7c7644f660553d3e3139043f9

SHA1
13cac175623eaec933edfced3834e452f5cef9b0

SHA256
f041fce4c536d3b72f3525e74bb53dcc808cdf65c37541ffa36fa88165cadd65

SHA512
74bbf6935a32363eed48cf15ac85553f245148eda5109ab9de6c5a1187cf0ac2ffad480f94675775146e72f338d26c9c77450a95b180b4a79d51c1a5f3aeeb16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe

Filesize
468KB

MD5
cc0638a12bf2534943d3d197f7feaa5a

SHA1
d4e62fadf8b9d168f6b4caa634ce8a218ece759b

SHA256
15d42a742d3b3222db00ebc59dc2ea6975fc4058e3a1bcb3df7f5d507a24d755

SHA512
04961a5ba5e0da3262800736712c16a15fcf1f5ccffcc89b016b418f500ced67a17517c4ed7246031e16b45b5444056d47321ad5612929373032f6ca55f20ff8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads