631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436ed

Analysis

max time kernel
119s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe
Size

468KB
MD5

9de33c993657d3868ef42a3d19ddb340
SHA1

b6665cc00622dc7f263831f100aa091fbb263259
SHA256

631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436ed
SHA512

5661d0ed051cd05303dbf6926ff115fd8513054d230cb6a71f78a4c63f606ca9588a9448538395cf58187b76f7a62f3cb3ed42b1e829597ae7644672104332ee
SSDEEP

3072:g3oMogLdjv8UtbYsPzxpff5dfrjXIpjnmHevVpDMl5H2VPNKglh:g37ooUUt/Ptpffn0FrMlRuPNK

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4708	Unicorn-17134.exe
2216	Unicorn-7979.exe
4388	Unicorn-61819.exe
3016	Unicorn-49972.exe
5048	Unicorn-32266.exe
2600	Unicorn-12400.exe
4252	Unicorn-26135.exe
2284	Unicorn-60024.exe
4584	Unicorn-3210.exe
648	Unicorn-35228.exe
3976	Unicorn-21492.exe
4372	Unicorn-41093.exe
4232	Unicorn-63916.exe
624	Unicorn-61731.exe
1612	Unicorn-16060.exe
3276	Unicorn-18006.exe
3696	Unicorn-42602.exe
4992	Unicorn-49287.exe
1712	Unicorn-12359.exe
348	Unicorn-20262.exe
3960	Unicorn-59422.exe
1564	Unicorn-42986.exe
2608	Unicorn-29250.exe
3496	Unicorn-22474.exe
3196	Unicorn-49116.exe
1436	Unicorn-13543.exe
2376	Unicorn-37532.exe
4300	Unicorn-19734.exe
3320	Unicorn-27902.exe
632	Unicorn-46931.exe
2624	Unicorn-60666.exe
552	Unicorn-9427.exe
1180	Unicorn-48322.exe
3324	Unicorn-63267.exe
4332	Unicorn-48322.exe
3064	Unicorn-19633.exe
888	Unicorn-25499.exe
4032	Unicorn-3589.exe
2508	Unicorn-10995.exe
3280	Unicorn-36262.exe
4968	Unicorn-55291.exe
2104	Unicorn-13703.exe
1628	Unicorn-13703.exe
2712	Unicorn-52598.exe
1688	Unicorn-30040.exe
4620	Unicorn-30040.exe
4104	Unicorn-53153.exe
4472	Unicorn-53153.exe
1812	Unicorn-18342.exe
968	Unicorn-7481.exe
3272	Unicorn-51637.exe
4892	Unicorn-11300.exe
4928	Unicorn-9519.exe
3524	Unicorn-3781.exe
4696	Unicorn-38327.exe
1076	Unicorn-14663.exe
3732	Unicorn-4912.exe
1500	Unicorn-37606.exe
2612	Unicorn-56635.exe
4432	Unicorn-49858.exe
224	Unicorn-23216.exe
2144	Unicorn-35203.exe
2040	Unicorn-16994.exe
2148	Unicorn-47720.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
5660	3324	WerFault.exe	120
11024	8708	WerFault.exe	411
14196	12780	WerFault.exe	607
15264	15004	WerFault.exe	705
15096	7608	WerFault.exe	315
5964	4836	WerFault.exe	267

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8981.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4228	dwm.exe
Token: SeChangeNotifyPrivilege	4228	dwm.exe
Token: 33	4228	dwm.exe
Token: SeIncBasePriorityPrivilege	4228	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5020	631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe
4708	Unicorn-17134.exe
4388	Unicorn-61819.exe
2216	Unicorn-7979.exe
3016	Unicorn-49972.exe
5048	Unicorn-32266.exe
2600	Unicorn-12400.exe
4252	Unicorn-26135.exe
2284	Unicorn-60024.exe
4584	Unicorn-3210.exe
4372	Unicorn-41093.exe
648	Unicorn-35228.exe
3976	Unicorn-21492.exe
4232	Unicorn-63916.exe
624	Unicorn-61731.exe
1612	Unicorn-16060.exe
3276	Unicorn-18006.exe
3696	Unicorn-42602.exe
4992	Unicorn-49287.exe
348	Unicorn-20262.exe
1712	Unicorn-12359.exe
3960	Unicorn-59422.exe
1564	Unicorn-42986.exe
1436	Unicorn-13543.exe
3196	Unicorn-49116.exe
3496	Unicorn-22474.exe
2608	Unicorn-29250.exe
2376	Unicorn-37532.exe
4300	Unicorn-19734.exe
3320	Unicorn-27902.exe
632	Unicorn-46931.exe
2624	Unicorn-60666.exe
552	Unicorn-9427.exe
888	Unicorn-25499.exe
1180	Unicorn-48322.exe
3324	Unicorn-63267.exe
3064	Unicorn-19633.exe
4332	Unicorn-48322.exe
4032	Unicorn-3589.exe
2508	Unicorn-10995.exe
3280	Unicorn-36262.exe
2104	Unicorn-13703.exe
4968	Unicorn-55291.exe
1628	Unicorn-13703.exe
2712	Unicorn-52598.exe
1688	Unicorn-30040.exe
4620	Unicorn-30040.exe
4104	Unicorn-53153.exe
4472	Unicorn-53153.exe
1812	Unicorn-18342.exe
3272	Unicorn-51637.exe
968	Unicorn-7481.exe
4928	Unicorn-9519.exe
4892	Unicorn-11300.exe
3524	Unicorn-3781.exe
4696	Unicorn-38327.exe
1076	Unicorn-14663.exe
3732	Unicorn-4912.exe
1500	Unicorn-37606.exe
2612	Unicorn-56635.exe
4432	Unicorn-49858.exe
2040	Unicorn-16994.exe
2144	Unicorn-35203.exe
224	Unicorn-23216.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4708	5020	631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe	82
PID 5020 wrote to memory of 4708	5020	631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe	82
PID 5020 wrote to memory of 4708	5020	631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe	82
PID 4708 wrote to memory of 2216	4708	Unicorn-17134.exe	83
PID 4708 wrote to memory of 2216	4708	Unicorn-17134.exe	83
PID 4708 wrote to memory of 2216	4708	Unicorn-17134.exe	83
PID 5020 wrote to memory of 4388	5020	631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe	84
PID 5020 wrote to memory of 4388	5020	631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe	84
PID 5020 wrote to memory of 4388	5020	631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe	84
PID 4388 wrote to memory of 3016	4388	Unicorn-61819.exe	85
PID 4388 wrote to memory of 3016	4388	Unicorn-61819.exe	85
PID 4388 wrote to memory of 3016	4388	Unicorn-61819.exe	85
PID 2216 wrote to memory of 5048	2216	Unicorn-7979.exe	86
PID 2216 wrote to memory of 5048	2216	Unicorn-7979.exe	86
PID 2216 wrote to memory of 5048	2216	Unicorn-7979.exe	86
PID 4708 wrote to memory of 2600	4708	Unicorn-17134.exe	88
PID 4708 wrote to memory of 2600	4708	Unicorn-17134.exe	88
PID 4708 wrote to memory of 2600	4708	Unicorn-17134.exe	88
PID 5020 wrote to memory of 4252	5020	631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe	87
PID 5020 wrote to memory of 4252	5020	631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe	87
PID 5020 wrote to memory of 4252	5020	631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe	87
PID 3016 wrote to memory of 2284	3016	Unicorn-49972.exe	89
PID 3016 wrote to memory of 2284	3016	Unicorn-49972.exe	89
PID 3016 wrote to memory of 2284	3016	Unicorn-49972.exe	89
PID 4388 wrote to memory of 4584	4388	Unicorn-61819.exe	90
PID 4388 wrote to memory of 4584	4388	Unicorn-61819.exe	90
PID 4388 wrote to memory of 4584	4388	Unicorn-61819.exe	90
PID 4708 wrote to memory of 648	4708	Unicorn-17134.exe	91
PID 4708 wrote to memory of 648	4708	Unicorn-17134.exe	91
PID 4708 wrote to memory of 648	4708	Unicorn-17134.exe	91
PID 2216 wrote to memory of 3976	2216	Unicorn-7979.exe	93
PID 2216 wrote to memory of 3976	2216	Unicorn-7979.exe	93
PID 2216 wrote to memory of 3976	2216	Unicorn-7979.exe	93
PID 5020 wrote to memory of 4372	5020	631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe	92
PID 5020 wrote to memory of 4372	5020	631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe	92
PID 5020 wrote to memory of 4372	5020	631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe	92
PID 4252 wrote to memory of 4232	4252	Unicorn-26135.exe	94
PID 4252 wrote to memory of 4232	4252	Unicorn-26135.exe	94
PID 4252 wrote to memory of 4232	4252	Unicorn-26135.exe	94
PID 3016 wrote to memory of 624	3016	Unicorn-49972.exe	97
PID 3016 wrote to memory of 624	3016	Unicorn-49972.exe	97
PID 3016 wrote to memory of 624	3016	Unicorn-49972.exe	97
PID 2284 wrote to memory of 1612	2284	Unicorn-60024.exe	98
PID 2284 wrote to memory of 1612	2284	Unicorn-60024.exe	98
PID 2284 wrote to memory of 1612	2284	Unicorn-60024.exe	98
PID 4584 wrote to memory of 3276	4584	Unicorn-3210.exe	99
PID 4584 wrote to memory of 3276	4584	Unicorn-3210.exe	99
PID 4584 wrote to memory of 3276	4584	Unicorn-3210.exe	99
PID 4388 wrote to memory of 3696	4388	Unicorn-61819.exe	100
PID 4388 wrote to memory of 3696	4388	Unicorn-61819.exe	100
PID 4388 wrote to memory of 3696	4388	Unicorn-61819.exe	100
PID 5048 wrote to memory of 4992	5048	Unicorn-32266.exe	101
PID 5048 wrote to memory of 4992	5048	Unicorn-32266.exe	101
PID 5048 wrote to memory of 4992	5048	Unicorn-32266.exe	101
PID 648 wrote to memory of 1712	648	Unicorn-35228.exe	103
PID 648 wrote to memory of 1712	648	Unicorn-35228.exe	103
PID 648 wrote to memory of 1712	648	Unicorn-35228.exe	103
PID 4708 wrote to memory of 348	4708	Unicorn-17134.exe	104
PID 4708 wrote to memory of 348	4708	Unicorn-17134.exe	104
PID 4708 wrote to memory of 348	4708	Unicorn-17134.exe	104
PID 4372 wrote to memory of 3960	4372	Unicorn-41093.exe	105
PID 4372 wrote to memory of 3960	4372	Unicorn-41093.exe	105
PID 4372 wrote to memory of 3960	4372	Unicorn-41093.exe	105
PID 2216 wrote to memory of 1564	2216	Unicorn-7979.exe	106

C:\Users\Admin\AppData\Local\Temp\631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe
"C:\Users\Admin\AppData\Local\Temp\631d958f00025c0398177c9ee209909b6a0b4c066ffea6ec39df40339d5436edN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7979.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49287.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48322.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
        7⤵
        Executes dropped EXE
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        9⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41112.exe
        10⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        10⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        10⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        10⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        9⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
        9⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13991.exe
        9⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12556.exe
        8⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        8⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
        8⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        8⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29929.exe
        7⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59705.exe
        7⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37968.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35406.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29324.exe
        8⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63940.exe
        9⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        8⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe
        8⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25295.exe
        8⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6526.exe
        7⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11787.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
        7⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
        7⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26151.exe
        6⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27508.exe
        7⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
        7⤵
        
        PID:11928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        7⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46675.exe
        7⤵
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53693.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30043.exe
        6⤵
        
        PID:12076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        6⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20480.exe
        6⤵
        
        PID:15700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29246.exe
        6⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31130.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37814.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        8⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
        8⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49991.exe
        8⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60351.exe
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        7⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1106.exe
        7⤵
        
        PID:15344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        7⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        7⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
        7⤵
        
        PID:13360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57366.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56355.exe
        6⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32705.exe
        6⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18791.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57569.exe
        5⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51524.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
        7⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        7⤵
        
        PID:13988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe
        6⤵
        
        PID:13088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        6⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31301.exe
        5⤵
        
        PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10568.exe
        5⤵
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37154.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34253.exe
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21492.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-377.exe
        8⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54534.exe
        9⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19684.exe
        9⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47007.exe
        9⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24304.exe
        9⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64933.exe
        8⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe
        8⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35266.exe
        8⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
        8⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        7⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        7⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2654.exe
        7⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40825.exe
        7⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        8⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        8⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
        8⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
        7⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        6⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
        6⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        6⤵
        
        PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18342.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35572.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
        8⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        8⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6656.exe
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe
        7⤵
        
        PID:13104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51669.exe
        6⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17459.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe
        6⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        6⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        7⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
        7⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2475.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        6⤵
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
        6⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
        5⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        5⤵
        
        PID:10360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6850.exe
        5⤵
        
        PID:12680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30040.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        8⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
        8⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9538.exe
        8⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        7⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        7⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46950.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22335.exe
        7⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        6⤵
        
        PID:13224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14808.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26418.exe
        6⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10330.exe
        6⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47976.exe
        6⤵
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
        5⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54808.exe
        5⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24632.exe
        5⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        5⤵
        
        PID:10156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40128.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        7⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
        7⤵
        
        PID:14692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44129.exe
        6⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51206.exe
        6⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41503.exe
        5⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10935.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        6⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15210.exe
        5⤵
        
        PID:14348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        6⤵
        
        PID:12780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12780 -s 464
        7⤵
        Program crash
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
        6⤵
        
        PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60639.exe
        5⤵
        
        PID:14328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15259.exe
        5⤵
        
        PID:9788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30884.exe
      4⤵
      PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
      4⤵
      PID:10820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
      4⤵
      PID:14004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        8⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        8⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52270.exe
        7⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
        7⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16852.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        7⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exe
        6⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34480.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4386.exe
        7⤵
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        6⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        6⤵
        
        PID:11136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16168.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39424.exe
        6⤵
        
        PID:336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-869.exe
        6⤵
        
        PID:15756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31169.exe
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2189.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1396.exe
        5⤵
        
        PID:14624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16012.exe
        5⤵
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        5⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38312.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65343.exe
        7⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        7⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
        7⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
        6⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        6⤵
        
        PID:12120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34485.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22606.exe
        6⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11648.exe
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56852.exe
        5⤵
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-317.exe
        5⤵
        
        PID:32
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50408.exe
        5⤵
        
        PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-377.exe
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
        6⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43028.exe
        5⤵
        
        PID:8380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
        5⤵
        
        PID:11360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        5⤵
        
        PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24688.exe
      4⤵
      PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15381.exe
      4⤵
      PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3371.exe
      4⤵
      PID:13184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
      4⤵
      PID:15708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29822.exe
        6⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38312.exe
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61202.exe
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        9⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        9⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27104.exe
        9⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16455.exe
        8⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
        8⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43630.exe
        7⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        7⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54671.exe
        7⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26553.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55602.exe
        6⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43459.exe
        6⤵
        
        PID:15812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        5⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65530.exe
        6⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22036.exe
        7⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5807.exe
        7⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58527.exe
        6⤵
        
        PID:12656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21657.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        6⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9181.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59889.exe
        5⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21657.exe
        5⤵
        
        PID:11744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37265.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55291.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13485.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28556.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20248.exe
        7⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        7⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        7⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60639.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9266.exe
        5⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        5⤵
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        5⤵
        
        PID:12636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28351.exe
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe
        5⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62279.exe
        5⤵
        
        PID:11916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        5⤵
        
        PID:15080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59804.exe
        5⤵
        
        PID:15716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14249.exe
      4⤵
      PID:9976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11126.exe
      4⤵
      PID:13340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        5⤵
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31130.exe
        6⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        7⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        8⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38781.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        7⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
        7⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43630.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        6⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        5⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40647.exe
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54330.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exe
        5⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
      4⤵
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        6⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        6⤵
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39411.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
        6⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17180.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37265.exe
        5⤵
        
        PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
      4⤵
      PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25432.exe
        5⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15566.exe
        5⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34545.exe
        5⤵
        
        PID:12520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63231.exe
      4⤵
      PID:8204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe
      4⤵
      PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16170.exe
      4⤵
      PID:15044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10995.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
      4⤵
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exe
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        6⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        7⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        7⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15182.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2065.exe
        6⤵
        
        PID:14076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-982.exe
        6⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43630.exe
        5⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50490.exe
        5⤵
        
        PID:11552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26789.exe
        5⤵
        
        PID:15348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        5⤵
        
        PID:10340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
      4⤵
      PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13018.exe
      4⤵
      PID:9272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1621.exe
      4⤵
      PID:13352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
      4⤵
      PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exe
      4⤵
      PID:10440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
    3⤵
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2131.exe
      4⤵
      PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        5⤵
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37940.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56405.exe
        5⤵
        
        PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
      4⤵
      PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64530.exe
      4⤵
      PID:11496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
      4⤵
      PID:5820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29694.exe
    3⤵
    PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44158.exe
      4⤵
      PID:13908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
      4⤵
      PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
    3⤵
    PID:9192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23142.exe
    3⤵
    PID:13240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe
    3⤵
    PID:440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49207.exe
    3⤵
    PID:10504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61819.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61819.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49972.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60024.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        8⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        9⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        10⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
        10⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41658.exe
        9⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7353.exe
        9⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22005.exe
        9⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        8⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        9⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe
        9⤵
        
        PID:14424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18282.exe
        9⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64522.exe
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36929.exe
        8⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50063.exe
        8⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2364.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
        8⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        8⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        8⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        8⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
        7⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-278.exe
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7259.exe
        7⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45744.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4912.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34674.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59500.exe
        8⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        9⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
        9⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        8⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23909.exe
        8⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15321.exe
        8⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18267.exe
        8⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28534.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        8⤵
        
        PID:13960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52757.exe
        8⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        7⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58143.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29680.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        7⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57132.exe
        6⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
        8⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45533.exe
        8⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52517.exe
        8⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22384.exe
        7⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exe
        6⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28794.exe
        6⤵
        
        PID:13320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31322.exe
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20252.exe
        8⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        8⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54984.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exe
        7⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27303.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35266.exe
        7⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
        7⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
        7⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40647.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49478.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52035.exe
        6⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23115.exe
        5⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33076.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        7⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24895.exe
        7⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62446.exe
        7⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        7⤵
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11595.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        6⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37087.exe
        6⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        5⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36506.exe
        6⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        6⤵
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4779.exe
        6⤵
        
        PID:15004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15004 -s 460
        7⤵
        Program crash
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5365.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16764.exe
        5⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57740.exe
        5⤵
        
        PID:15144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28716.exe
        5⤵
        
        PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61731.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10491.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        9⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        9⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        9⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49827.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        8⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
        8⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59103.exe
        8⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
        8⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45289.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13344.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20021.exe
        7⤵
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21378.exe
        6⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
        8⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54269.exe
        7⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24047.exe
        7⤵
        
        PID:12516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14938.exe
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe
        6⤵
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13145.exe
        6⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56635.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41244.exe
        6⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36754.exe
        7⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
        7⤵
        
        PID:15088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
        6⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28543.exe
        6⤵
        
        PID:14708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        6⤵
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        6⤵
        
        PID:11500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12939.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23486.exe
        6⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8221.exe
        7⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe
        7⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
        7⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64383.exe
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        6⤵
        
        PID:14040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50567.exe
        6⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5706.exe
        5⤵
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        5⤵
        
        PID:14792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60666.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49858.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24176.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
        7⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50490.exe
        7⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41371.exe
        7⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30519.exe
        7⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61565.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        6⤵
        
        PID:12328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
        6⤵
        
        PID:9956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64741.exe
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6127.exe
        6⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        6⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53955.exe
        6⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        5⤵
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48379.exe
        5⤵
        
        PID:11008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13655.exe
        5⤵
        
        PID:14804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35203.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22530.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        6⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10909.exe
        7⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
        7⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        7⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        6⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
        6⤵
        
        PID:15236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11263.exe
        5⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
        5⤵
        
        PID:11820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
        5⤵
        
        PID:15268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
      4⤵
      PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        5⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30178.exe
        6⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63397.exe
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
        5⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49717.exe
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
        5⤵
        
        PID:10584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31076.exe
      4⤵
      PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54107.exe
      4⤵
      PID:14780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18006.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9427.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35036.exe
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3314.exe
        7⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30461.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-164.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9187.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        6⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exe
        5⤵
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38644.exe
        7⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45672.exe
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5574.exe
        7⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40184.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        6⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37848.exe
        6⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18075.exe
        6⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11809.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64683.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50748.exe
        6⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57777.exe
        5⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30043.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7206.exe
        5⤵
        
        PID:15956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3324
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 636
        5⤵
        Program crash
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-557.exe
      4⤵
      PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38452.exe
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        6⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        6⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21481.exe
        6⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37252.exe
        5⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12642.exe
        5⤵
        
        PID:11020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13145.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15981.exe
        5⤵
        
        PID:9100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        5⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6777.exe
        5⤵
        
        PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54566.exe
      4⤵
      PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
      4⤵
      PID:11296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33236.exe
      4⤵
      PID:15056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42602.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48322.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16994.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35406.exe
        6⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24895.exe
        7⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54278.exe
        7⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43630.exe
        6⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22011.exe
        6⤵
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3314.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        6⤵
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57366.exe
        5⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46764.exe
        5⤵
        
        PID:11460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
      4⤵
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65530.exe
        5⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        6⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40488.exe
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28837.exe
        6⤵
        
        PID:14640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
        6⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44129.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51206.exe
        5⤵
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9253.exe
        5⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34072.exe
        5⤵
        
        PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33909.exe
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5333.exe
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24152.exe
        5⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28837.exe
        5⤵
        
        PID:14540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59889.exe
      4⤵
      PID:9664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21657.exe
      4⤵
      PID:12928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
      4⤵
      PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47585.exe
      4⤵
      PID:10388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25499.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
      4⤵
      PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        5⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
        6⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34092.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
      4⤵
      PID:4836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 640
        5⤵
        Program crash
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
      4⤵
      PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28263.exe
      4⤵
      PID:13328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11007.exe
      4⤵
      PID:7104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
    3⤵
    PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
      4⤵
      PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
        5⤵
        
        PID:14380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57916.exe
      4⤵
      PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
      4⤵
      PID:12900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53801.exe
      4⤵
      PID:5900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53469.exe
    3⤵
    PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
      4⤵
      PID:9992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37338.exe
      4⤵
      PID:12792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
      4⤵
      PID:10352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51754.exe
    3⤵
    PID:9692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35467.exe
    3⤵
    PID:12912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12006.exe
    3⤵
    PID:456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26135.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26135.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13703.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        8⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7598.exe
        8⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        8⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24867.exe
        7⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
        7⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        6⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        7⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8708 -s 472
        8⤵
        Program crash
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
        7⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60685.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        7⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        6⤵
        
        PID:12100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5269.exe
        6⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22875.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3542.exe
        5⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        7⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        7⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exe
        7⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24304.exe
        7⤵
        
        PID:15872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16194.exe
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
        6⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exe
        6⤵
        
        PID:9660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33333.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35266.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-721.exe
        6⤵
        
        PID:13772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56983.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
        5⤵
        
        PID:13612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53153.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        6⤵
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
        6⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        5⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        5⤵
        
        PID:10380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe
        5⤵
        
        PID:13160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16099.exe
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        5⤵
        
        PID:7608
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7608 -s 488
        6⤵
        Program crash
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2467.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60639.exe
        5⤵
        
        PID:13344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
      4⤵
      PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
      4⤵
      PID:10552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4712.exe
      4⤵
      PID:12836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7481.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7022.exe
        7⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61558.exe
        7⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        6⤵
        
        PID:12972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32480.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40210.exe
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        5⤵
        
        PID:13112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8262.exe
        5⤵
        
        PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
        5⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        5⤵
        
        PID:8468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34101.exe
      4⤵
      PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
      4⤵
      PID:10020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4712.exe
      4⤵
      PID:13380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59500.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60180.exe
        6⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16237.exe
        6⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        6⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe
        6⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22537.exe
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27343.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
      4⤵
      PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exe
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exe
      4⤵
      PID:10456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3682.exe
    3⤵
    PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8135.exe
      4⤵
      PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
      4⤵
      PID:9356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
      4⤵
      PID:13420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
      4⤵
      PID:1280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
    3⤵
    PID:12808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59422.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13703.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        7⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        7⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3500.exe
        7⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16194.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50524.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
        6⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
        5⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15210.exe
        5⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16012.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        5⤵
        
        PID:15728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59157.exe
      4⤵
      PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        6⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
        6⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50524.exe
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
        5⤵
        
        PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
      4⤵
      PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63307.exe
        5⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        5⤵
        
        PID:10868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
      4⤵
      PID:9996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
      4⤵
      PID:12060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
      4⤵
      PID:1456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53153.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
      4⤵
      PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65530.exe
        5⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-455.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7400.exe
        6⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
        5⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64530.exe
        5⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50847.exe
        5⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-516.exe
        5⤵
        
        PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46817.exe
      4⤵
      PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
        5⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54024.exe
      4⤵
      PID:9680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
      4⤵
      PID:13012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1092.exe
      4⤵
      PID:7044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48580.exe
    3⤵
    PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
      4⤵
      PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        5⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        5⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9726.exe
        5⤵
        
        PID:8784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
      4⤵
      PID:12108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
      4⤵
      PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
    3⤵
    PID:5980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
    3⤵
    PID:8268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32942.exe
    3⤵
    PID:13216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
    3⤵
    PID:15864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30040.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38312.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62318.exe
        6⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        6⤵
        
        PID:11984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8069.exe
        6⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62466.exe
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19535.exe
        6⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
        5⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
        5⤵
        
        PID:14552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
        5⤵
        
        PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe
        5⤵
        
        PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19598.exe
      4⤵
      PID:216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35266.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57401.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24805.exe
        5⤵
        
        PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51118.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
      4⤵
      PID:13540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45535.exe
    3⤵
    PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25240.exe
      4⤵
      PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
      4⤵
      PID:9868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49730.exe
      4⤵
      PID:13932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
    3⤵
    PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7753.exe
      4⤵
      PID:15768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5618.exe
    3⤵
    PID:10400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23385.exe
    3⤵
    PID:14292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51637.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51637.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
    3⤵
    PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
      4⤵
      PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
      4⤵
      PID:9936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55377.exe
      4⤵
      PID:14520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
    3⤵
    PID:7356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
    3⤵
    PID:10312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe
    3⤵
    PID:14308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exe
  2⤵
  PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28556.exe
    3⤵
    PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
      4⤵
      PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60639.exe
    3⤵
    PID:9600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26419.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26419.exe
  2⤵
  PID:7640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
  2⤵
  PID:10612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
  2⤵
  PID:12768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3324 -ip 3324
1⤵
PID:5172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 8708 -ip 8708
1⤵
PID:10132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 12780 -ip 12780
1⤵
PID:14068

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 7608 -ip 7608
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4836 -ip 4836
1⤵
PID:6184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe

Filesize
468KB

MD5
6165727b1dbb38e871db8dd880ac8326

SHA1
7c6cb8c737f6baca0512974b8717f5eea71c870b

SHA256
e2090773f31b36db9fecf32a3d70287699cd539d8b441e9c3c11c01b136e4566

SHA512
5ce8f04bead8b60f9386fb1639a916692bc5831cb2f587c491885d8ead10ca4277dd0dede8a8bb447a53e71b04f62f34709c49c78291abd8492e49774dc8320c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe

Filesize
468KB

MD5
064ea354df1daf5113bb591b11fac077

SHA1
c827028184563d4e4f09e6d0e43274143d440da9

SHA256
f8a5986c237ae00501c74b959875748fe2d56e14579cb580537fceaa85ca4d80

SHA512
3d01dbceeb0d2a125c95b9024551e4fab1dc49ce3620121f3bab134810e67805ad64d7240e40c7aab6ae97184a71e457ce59ed2342c9453d125bbb3c1ec6d1f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe

Filesize
468KB

MD5
12a917293135c35b1672a0e993180c8d

SHA1
85109ec3465e65c1d1dd639144e136b96012821c

SHA256
cee2bc9b9f33972bb4ab19af6c41d40de99e0da20262e9cd6615de63b6398cc5

SHA512
fb70bb4b2d94fc80331ee2df188509f8f5c6053fc6ed9b24ff6ee2492056186aaa38ace073d9ff647895fc443b87c3a8c2b921621671e5051b9805a024004de6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe

Filesize
468KB

MD5
324dce7c23770fae6d52c71bbb5e9bba

SHA1
78dacfde9187865f8f98426e1a5308464c68a512

SHA256
6cbc723a06f8f74c1faf9628a7cbe6f46679fc29aceebc73b8ca5aaf8ef299c3

SHA512
0af68d6d08f119a656ab180fab20db3a083f010682ad691c2ff5778576fdf916bed15864ca0ca827f804f327e3ea15cc4e38cd2d6c01857bbf525a6ba5bc9f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe

Filesize
468KB

MD5
4a69f6db87c3f6a3c34eb131a30cc97b

SHA1
e72ec5b4958db00a108087dedaacd0c1f115fddf

SHA256
858e47835672432832e08a5e6e6d6d6295f2f17b992f71491c132ca0061ad0bf

SHA512
7e8df9da0019be8e3d8228b9ca6a06caa3c02e2d7586e3a81b88acdaf3e91d2e60e876558c186ff2be2f6ba53189340f7cdbf4456ff5b6397e10a6343015315a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18006.exe

Filesize
468KB

MD5
92c9266b695f8a0e23660523916d5e16

SHA1
45b219a75586d835ae9a9c7e6badd766bd124c20

SHA256
70f536abd82787d79fe65829b3c66ce989b3739f25dbf8898827b93ac46214ec

SHA512
d71e989246fa7636058ed0735a502fe113c9da18e281a38eab5a6bd6b6b976d7322b09a74e2514a15b3671c242b47ed017af2ee808830369c5ead6a8cbb6fa60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe

Filesize
468KB

MD5
44f4a24b7a14d0fa1e9b867034e543d4

SHA1
12665e4477fccf1446b185c6c72e63b12ebb4314

SHA256
93ad1ab74919896fe9d39b333b7ec49bf0ef5825ad6c4d943800a2cc6ffe184b

SHA512
0bee3da0515f18203768ef214588c528b236c3a6b34771cd852037214d25ed7197f0e47b392293eb053b0d64429b40d8b602ef8f8072ad223d03ddae16bad6b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe

Filesize
468KB

MD5
218aefccb4e7c8fbbdb77c3f252460c6

SHA1
defbe624b0f8a7ab7d21ee2c6e2795145bcc1b28

SHA256
edaf5a402d8474183f6a818c2e8ff69c02f510f5883475cb156aee770dd623ad

SHA512
179aaf65e41ef3c6ade59b073804870c9a4c1795ffcc7ebbbd49c12b3426db7a843b278e0571c2aee3ab4568a04bda70cdaeeb99479acde9129c5c2eb7276a0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21492.exe

Filesize
468KB

MD5
f437d9b2544f08f0e802e2844586c215

SHA1
093ab9146281b27c14e45a84dcfc9a8a37b7a608

SHA256
d648e88dc4a84da41cc24583df2dfed5a4ae49df1797b026babd3fa45ad67964

SHA512
94e8d999d4b20eee75c65927583f7ccf0b0684f65a26916ddaf5904f5590b7dbee9cda2d167ab0da88879c5768c06719a933006aa35775094ffda9c6eb260d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe

Filesize
468KB

MD5
e35749479cf3fb51033dbf5e6646de11

SHA1
0b7b25bf68a83ee02206dd22971a9b618d711eb2

SHA256
737daf1d10e696dd936396385a10ca15b2b78267453b32f5ecd2e25c01687c3c

SHA512
b1854c6b6743f4997785a52e50fffc1c38fc2ddfbf879ecbd0cc926891dbe03b9bab86ffb86d585eb61d9af9f60db411279c1c6d85d048f8fc99a1912fda0ca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26135.exe

Filesize
468KB

MD5
9e2b0748ab5aa03ea484177df2538070

SHA1
2b60a199fbd5dd2151978bb39ac9cc7410d81e2b

SHA256
02996a765d9b3ef1db0cd4186a867d7ce1d2f1f1a8d8325bb74a81d23e2077e7

SHA512
7935d9a6d8a1cdd8fc6e5edb33fb1353fa596d2d9ce8d9768d985c71203b7beb3d1ece2e4b2decb06fd1f7aa94dc39ae656393d729846bc30cf6b7cd4a8830cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe

Filesize
468KB

MD5
f3f59aaeaa9d81deadde35fad3c9ee73

SHA1
4b00ba4ed4b79ff6f85f2876b4e76170f9b03e44

SHA256
28e26a56d25d08691a26e4c84b2a795db3baee2d5864ae6013b48e4588941f05

SHA512
58f96d27a28b70b0133119f89bc7672920ab16619ebe6106221b0883aa43c6e0d40846cab9944dcb33a3316be7cd9dc84339dbaedaaadb3c030d20cdbc2081be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe

Filesize
468KB

MD5
e718f6b651593b8aae4c70e82728593c

SHA1
32b1756d9fe1fc7df85c4aff5f26f9eefc38ceb4

SHA256
5ea683dc9cb107885af7192c34b135034713be74a3ec7ab08ac68679d282fbe0

SHA512
2f26fca8fc38c5335b48a94336e26902b35f7c0e33e44336406f28a44f1018dabe3eb32199ab84c9e8b38e716fd2d720afca2b695f8ea3ffea0b520d19f2e109

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe

Filesize
468KB

MD5
69ec300663ce6320e7361773e0a69b16

SHA1
b25eb30f9260a17d95c1f36305e36bc199a8e3ea

SHA256
76d9f79466096ab2d1f2e4dc05aafd97a4454ce6600018421c893f7ce4cac2e9

SHA512
24a43fd0d5b898c69ce4b2b63e7be6cd23a5c76560236d8f38868ceda448d6ce4ed405bda09e1bdeb9ab5a9171866a43db1e48409cdd733ff226ee426d9d786b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe

Filesize
468KB

MD5
6c491aa04ff5c0dc2833b46464be838b

SHA1
0f85a74df39998bf5a196c383b6efa4eb5d50df6

SHA256
dd8a6677aac63cd4cb517316a09b248ad34c75c30ef7f10bf04cdaef68b955ad

SHA512
c20714186a28f079dc255c228cc608d52bc69587a9ad259e59dbde1ba4661374ebad2619e052c4003488364f0b556d02596cfe421761d39a1447bc4d2bea241b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe

Filesize
468KB

MD5
fcc618ee908a132700837e53ef52ab62

SHA1
6419c1a694ff3a394eed99349ce5d36970e4e3b2

SHA256
1bbb811f09d15dc0c54a8b218418922d2235c20bfac22e625a96575656a1067b

SHA512
e78f28a1ff44d8c461f944505a83d5c35549df504844a4b5af676e01058d7fb98e5ee2da1c6a41b4c911125e3730e9929f06fe40cba90fefbc556cde4ac1d711

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe

Filesize
468KB

MD5
de1ae62c692bd77e595721aadd4679fb

SHA1
85e28148eeb2c673440cdec0b75d29fabc02fe30

SHA256
86cf0414a7ade09e627c6e387c2bfe4e75759063f379fa4fc3ca278158711a8f

SHA512
680b15ba1bdf5c6c37f92d25df7bd3c3aa5c91a0bd20b78315a6efc8231c5742cb64823822a5eec6229ff29b0d0771e2ef444fc87bf0aec65c9aef2023d1b33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe

Filesize
468KB

MD5
2e608c7d7a232bd4ba9a98b8fba8a91b

SHA1
256d007df05434380f7b2a45d3e6ad2d642ab6fc

SHA256
fa75abde77c9a2932f601e535160968d01326573db0e2999f248be768c6e02f8

SHA512
190f82250b4a01fe12913a409817c0751d1f2d1d3c4a97b69182535dfaa5e1849bbf4fe6d6857d851c8c82d337d4327435e2c60ec09a14f7c405c6f94178058f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42602.exe

Filesize
468KB

MD5
64c7405b79f835e70aad1c30d47f6c43

SHA1
3e0884390fb0d21ac69a5155a2b24b6a94f09d6b

SHA256
c53eb627c9d523561c4e588ea5bab1ac3e555a0cfc5866ad10f82160691c97c0

SHA512
2c9ba0012ee10d5fa86882882aa8609b5615314fdb69e7fb14b3ca94e2e87e6ba3c0499270e8b7e920660e0aa1fd0323b0f119a7bd81ae1b307009f9fabd34e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe

Filesize
468KB

MD5
dc40fae9a4ac095bce2ec8ddfb20ac81

SHA1
1b523a92c55d495f7ed57bea58d42be0dd86f6f8

SHA256
1c9fe23a8a75eb57d0ed994270683f03cdf4956066aba677898b41719bb8fa87

SHA512
28786c3cf561e105a6b78feccee81839f0af6d74cd2143906648040236b232dbb13b58c1f8c0da8106cb0f6e9350793b9adb4c38bcf1bc5bcb6baeaac0f7522b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe

Filesize
468KB

MD5
f48e232aaf7291fedf2fdb3e10c7b262

SHA1
3c5259c752ca604304d006915a9cdf7e21e1a8bf

SHA256
65a0ede7dafa3c045ea2e34e1c4a822860b7cc3d6c59f97bf86c63d7218bad04

SHA512
437293f7b4cbcc7033a43189759a6f9264591b1a20dcacdfcdd75061607537d43d99be5d12db71d82019448d0efbed31a640b57dbfd86f7f3b926cf965a51196

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe

Filesize
468KB

MD5
af8229e2ec9743b9e2ef3794178a8115

SHA1
8c71fa25f869381e3654f5eee7b3ad331a959ec7

SHA256
d92747959a36a3903213b406090b599bd5c26c2f044c28a5e827f774c97a6f5b

SHA512
7b355d20a5c2841686dd81ddb3effe01f2f60e4994a5df8ed0b2cc0d87ebf2301ff81cba3796d47c679b7e7ff9df7d77e0c0f3495f1fc332a5806fb8fba74e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49287.exe

Filesize
468KB

MD5
0e13e9fa1b8d59a2f625495a84d2d592

SHA1
f6a8bde739ca13a0fdbf0534066edc3c52e0f5b7

SHA256
929b3a4c337bfaddc2f318087ec09941fbac95072123b9e0eff3e87274e8cb92

SHA512
cb69055535580435f30132b0625360df307877754798dfafbef55ad29389016938b329702345055ea69383734a3d2cb93b5a54d0947623493adc03009cefa620

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49972.exe

Filesize
468KB

MD5
92020ac6dc04b4b36b4c18d299afe687

SHA1
b8d327015cd1e8fd02eff15aa999d7bf15e36902

SHA256
f94822daffae23e4c4e41ad0e5c3823327e40fc8eb002bb4616298fb9adee094

SHA512
a2f4f5b56faabd76e388c6b3dc9388944fdcf67cac54250a66f32019d44a4018399ddbbd8edf40cc897d2b618b6882826037b9913b20eee5d85f996bc927b55e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59422.exe

Filesize
468KB

MD5
fd2996157037f938aecbc26a86cde4a2

SHA1
1e2c54ab63a1b337eaafddb562a58199f7b0596c

SHA256
a7c6d3c4f3dddd4e9b97b696924c0ef484ad51684eb6edb6ce563fb85cf0dfa2

SHA512
4d4846e363310ee818da1c641217c8b2a6ea837bc39b76d02b04b69cce43dfd8d9289928ba25def9b4788bc9a7fedf80e0aed555c32a9389c983aa6d70b1a6f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60024.exe

Filesize
468KB

MD5
02aa904461a6ded673c968d855bb738e

SHA1
5d281e731c42778a3018d39c5cbad9755e548703

SHA256
2f7d978ab6b0c9421e938549a7298b036d30279a1a3bbced0abe7306adb95ede

SHA512
ac79c0c1dcd712c586eff56b89d4c13d99a6979416189c90ce1bbd1116cdde67eba156821582a02de9c0301bdbe0070163da07b8003cfa9f0f20d5924feca575

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60666.exe

Filesize
468KB

MD5
200cbfc77e10fba68d63b9cf60714018

SHA1
8cd1ed7c53a3eba9bd39244f1fcd22301e916456

SHA256
30bd3a3e3511c8a77fe91f7010de42b40581f6fd917d5c0c042fa5012a624f8a

SHA512
66698c3104cca5d3a2672feb7e9d61c29e7112fc7bdb43493294e980ff2bf82b46998477f85a8a881f75ff1b019082c67b0d353e5afb654a3591765d64c1b935

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61731.exe

Filesize
468KB

MD5
1242e1fb31e1c0c884eb65813a0c9b62

SHA1
bc13ff8f33f9958c53fb2321626872fcb3cf5f0e

SHA256
c901ede8b7daa9ce6fb783932e33392775488238afcdb9ac333930fc312266a9

SHA512
ca467c514b3cf7de5664c9be3ca17bc95ccb5b61864890c5c33d34959a5e9fa687dd6eb0ba6d78f77b004afe4c729b17c0b3357c925e76ba50cfb49b2b3dba9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61819.exe

Filesize
468KB

MD5
d17aef83f984de5dd7cb25cb6dda5df1

SHA1
95b47a3a4d84acccf2ba7ffe8a4dd1df5a299f7c

SHA256
ce042711dac2ea01f995cac9deffd955267fa0ace1e5d2c7dfe322377f1f15ae

SHA512
3b5dfd71842bd42592c0315914f02fcbfeae47c1296cbf2d35f6ef680dcaf47db68dd15b996a37e3b1af0eddb0a34362ca830d7b6cb9c1f9430a4bdb44be94e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe

Filesize
468KB

MD5
310458292d2a737706d52b17fa9ddf51

SHA1
cac575a78d9088d7c9f16e622b955909346c111f

SHA256
b13477b11815b66c049b6ca83e5f9bb8e6b71dde67fc0cd26fae8f8fc669b5ce

SHA512
c890ea7cadf9aea8acf788da33b132e3a05b17dbebbbaa30181533ea9cd8055e75c0c92b99208349ef7d1b02fd7b8ab2acf2222f33542b1ea11cf6abe2da351a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7979.exe

Filesize
468KB

MD5
19ed85ddc1553ab28cb1320f7e1914b6

SHA1
ba35500ee28c3ef0de755ce91a120fda03926f1b

SHA256
726512702c8812b7c4f35d3fb7cc9d7476a7dbb32a8fb4dfaa5103f155e955a3

SHA512
9fd5c79feb96300c72a7dde6e8fb9bdc59b3a59cf89ed9ef6a6258cd497e05c6db01af3a30978c0da4fad4457d8f02fd0d4bea961194a119205875226452ae4b

Download Submit
memory/224-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/348-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/552-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/624-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/632-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/648-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/816-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/888-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1076-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1180-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1436-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1612-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1812-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2104-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2144-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2292-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3272-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3276-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3280-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3320-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3324-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3496-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3524-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3696-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3700-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3708-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3720-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3732-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3816-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3828-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3976-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4032-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4104-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4192-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4232-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4252-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4300-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4388-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4584-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4696-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4708-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4856-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4892-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4928-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5380-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5392-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5436-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5464-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5472-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5528-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5540-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5572-559-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5628-565-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5640-566-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14792-2715-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads