7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179

Analysis

max time kernel
120s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe
Size

468KB
MD5

ac0dbf3a1746842510928de315618aa0
SHA1

6ff1837215d0f6409c61b01b60527e993c15b539
SHA256

7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179
SHA512

f9f10c53486e874e734bef50ee42844d93035b71aa2a77a9cd7294cc8693ebb8b34420a5790439188c63cd25544e0536eea1bfc916cf65a459d6a3fd08e21e0f
SSDEEP

3072:5ZACogbdhZJBtbYJPzcBff8/3ChzsaplnlHCxEuxde+2I18fEVEr:5Z1oy/BtOP4Bff8SmbdeRk8fE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4516	Unicorn-49302.exe
5044	Unicorn-22250.exe
3104	Unicorn-6468.exe
1532	Unicorn-32878.exe
3988	Unicorn-14495.exe
1636	Unicorn-760.exe
2760	Unicorn-15316.exe
2740	Unicorn-23890.exe
2080	Unicorn-64657.exe
4588	Unicorn-64922.exe
4872	Unicorn-62876.exe
688	Unicorn-49141.exe
4708	Unicorn-62182.exe
3388	Unicorn-64220.exe
2428	Unicorn-47361.exe
3116	Unicorn-25810.exe
2884	Unicorn-1305.exe
2280	Unicorn-55145.exe
1468	Unicorn-9473.exe
4168	Unicorn-61996.exe
2300	Unicorn-64796.exe
3764	Unicorn-51061.exe
2900	Unicorn-46157.exe
1956	Unicorn-16210.exe
4608	Unicorn-57242.exe
928	Unicorn-45545.exe
3504	Unicorn-48809.exe
1396	Unicorn-28654.exe
4252	Unicorn-22523.exe
2116	Unicorn-36992.exe
4496	Unicorn-36992.exe
3984	Unicorn-17170.exe
1256	Unicorn-568.exe
4804	Unicorn-37782.exe
624	Unicorn-50034.exe
5108	Unicorn-24762.exe
1644	Unicorn-24762.exe
952	Unicorn-18631.exe
4988	Unicorn-28846.exe
1796	Unicorn-54097.exe
2296	Unicorn-8425.exe
4896	Unicorn-37760.exe
3024	Unicorn-16594.exe
3124	Unicorn-40328.exe
1104	Unicorn-59664.exe
4960	Unicorn-52780.exe
2060	Unicorn-45929.exe
3200	Unicorn-5877.exe
4024	Unicorn-6624.exe
1412	Unicorn-26490.exe
4824	Unicorn-6069.exe
4800	Unicorn-51741.exe
1208	Unicorn-43572.exe
448	Unicorn-63438.exe
3468	Unicorn-46340.exe
636	Unicorn-43018.exe
1628	Unicorn-51186.exe
4264	Unicorn-46837.exe
1180	Unicorn-23366.exe
1744	Unicorn-29487.exe
2676	Unicorn-899.exe
924	Unicorn-899.exe
4996	Unicorn-44170.exe
1368	Unicorn-15368.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
7280	4824	WerFault.exe	139
7156	5556	WerFault.exe	190
9108	5612	WerFault.exe	194
7288	5620	WerFault.exe	195
10648	7092	WerFault.exe	272
16728	11972	WerFault.exe	686
17252	9336	WerFault.exe	424
7412	8680	WerFault.exe	379

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15587.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1092	dwm.exe
Token: SeChangeNotifyPrivilege	1092	dwm.exe
Token: 33	1092	dwm.exe
Token: SeIncBasePriorityPrivilege	1092	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe
4516	Unicorn-49302.exe
5044	Unicorn-22250.exe
3104	Unicorn-6468.exe
3988	Unicorn-14495.exe
1532	Unicorn-32878.exe
1636	Unicorn-760.exe
2760	Unicorn-15316.exe
2740	Unicorn-23890.exe
2080	Unicorn-64657.exe
4588	Unicorn-64922.exe
4872	Unicorn-62876.exe
688	Unicorn-49141.exe
4708	Unicorn-62182.exe
3388	Unicorn-64220.exe
2428	Unicorn-47361.exe
3116	Unicorn-25810.exe
2884	Unicorn-1305.exe
2300	Unicorn-64796.exe
2280	Unicorn-55145.exe
1468	Unicorn-9473.exe
3764	Unicorn-51061.exe
4168	Unicorn-61996.exe
2900	Unicorn-46157.exe
1956	Unicorn-16210.exe
928	Unicorn-45545.exe
4608	Unicorn-57242.exe
4252	Unicorn-22523.exe
3504	Unicorn-48809.exe
4496	Unicorn-36992.exe
2116	Unicorn-36992.exe
3984	Unicorn-17170.exe
1256	Unicorn-568.exe
4804	Unicorn-37782.exe
624	Unicorn-50034.exe
5108	Unicorn-24762.exe
952	Unicorn-18631.exe
2296	Unicorn-8425.exe
4988	Unicorn-28846.exe
1796	Unicorn-54097.exe
1644	Unicorn-24762.exe
3124	Unicorn-40328.exe
4896	Unicorn-37760.exe
1104	Unicorn-59664.exe
3024	Unicorn-16594.exe
2060	Unicorn-45929.exe
4960	Unicorn-52780.exe
3200	Unicorn-5877.exe
1412	Unicorn-26490.exe
4024	Unicorn-6624.exe
448	Unicorn-63438.exe
1208	Unicorn-43572.exe
4800	Unicorn-51741.exe
4824	Unicorn-6069.exe
1628	Unicorn-51186.exe
636	Unicorn-43018.exe
3468	Unicorn-46340.exe
924	Unicorn-899.exe
1744	Unicorn-29487.exe
2676	Unicorn-899.exe
4264	Unicorn-46837.exe
1180	Unicorn-23366.exe
4316	Unicorn-51762.exe
4996	Unicorn-44170.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4516	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	82
PID 1616 wrote to memory of 4516	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	82
PID 1616 wrote to memory of 4516	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	82
PID 4516 wrote to memory of 5044	4516	Unicorn-49302.exe	83
PID 4516 wrote to memory of 5044	4516	Unicorn-49302.exe	83
PID 4516 wrote to memory of 5044	4516	Unicorn-49302.exe	83
PID 1616 wrote to memory of 3104	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	84
PID 1616 wrote to memory of 3104	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	84
PID 1616 wrote to memory of 3104	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	84
PID 3104 wrote to memory of 1532	3104	Unicorn-6468.exe	89
PID 3104 wrote to memory of 1532	3104	Unicorn-6468.exe	89
PID 3104 wrote to memory of 1532	3104	Unicorn-6468.exe	89
PID 1616 wrote to memory of 3988	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	90
PID 1616 wrote to memory of 3988	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	90
PID 1616 wrote to memory of 3988	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	90
PID 4516 wrote to memory of 1636	4516	Unicorn-49302.exe	91
PID 4516 wrote to memory of 1636	4516	Unicorn-49302.exe	91
PID 4516 wrote to memory of 1636	4516	Unicorn-49302.exe	91
PID 5044 wrote to memory of 2760	5044	Unicorn-22250.exe	93
PID 5044 wrote to memory of 2760	5044	Unicorn-22250.exe	93
PID 5044 wrote to memory of 2760	5044	Unicorn-22250.exe	93
PID 3988 wrote to memory of 2740	3988	Unicorn-14495.exe	94
PID 3988 wrote to memory of 2740	3988	Unicorn-14495.exe	94
PID 3988 wrote to memory of 2740	3988	Unicorn-14495.exe	94
PID 1616 wrote to memory of 2080	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	95
PID 1616 wrote to memory of 2080	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	95
PID 1616 wrote to memory of 2080	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	95
PID 1532 wrote to memory of 4588	1532	Unicorn-32878.exe	96
PID 1532 wrote to memory of 4588	1532	Unicorn-32878.exe	96
PID 1532 wrote to memory of 4588	1532	Unicorn-32878.exe	96
PID 4516 wrote to memory of 4872	4516	Unicorn-49302.exe	97
PID 4516 wrote to memory of 4872	4516	Unicorn-49302.exe	97
PID 4516 wrote to memory of 4872	4516	Unicorn-49302.exe	97
PID 3104 wrote to memory of 688	3104	Unicorn-6468.exe	98
PID 3104 wrote to memory of 688	3104	Unicorn-6468.exe	98
PID 3104 wrote to memory of 688	3104	Unicorn-6468.exe	98
PID 2760 wrote to memory of 4708	2760	Unicorn-15316.exe	101
PID 2760 wrote to memory of 4708	2760	Unicorn-15316.exe	101
PID 2760 wrote to memory of 4708	2760	Unicorn-15316.exe	101
PID 5044 wrote to memory of 3388	5044	Unicorn-22250.exe	102
PID 5044 wrote to memory of 3388	5044	Unicorn-22250.exe	102
PID 5044 wrote to memory of 3388	5044	Unicorn-22250.exe	102
PID 1636 wrote to memory of 2428	1636	Unicorn-760.exe	103
PID 1636 wrote to memory of 2428	1636	Unicorn-760.exe	103
PID 1636 wrote to memory of 2428	1636	Unicorn-760.exe	103
PID 2740 wrote to memory of 3116	2740	Unicorn-23890.exe	104
PID 2740 wrote to memory of 3116	2740	Unicorn-23890.exe	104
PID 2740 wrote to memory of 3116	2740	Unicorn-23890.exe	104
PID 4588 wrote to memory of 2884	4588	Unicorn-64922.exe	105
PID 4588 wrote to memory of 2884	4588	Unicorn-64922.exe	105
PID 4588 wrote to memory of 2884	4588	Unicorn-64922.exe	105
PID 4872 wrote to memory of 1468	4872	Unicorn-62876.exe	106
PID 4872 wrote to memory of 1468	4872	Unicorn-62876.exe	106
PID 4872 wrote to memory of 1468	4872	Unicorn-62876.exe	106
PID 3988 wrote to memory of 2280	3988	Unicorn-14495.exe	107
PID 3988 wrote to memory of 2280	3988	Unicorn-14495.exe	107
PID 3988 wrote to memory of 2280	3988	Unicorn-14495.exe	107
PID 1616 wrote to memory of 4168	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	108
PID 1616 wrote to memory of 4168	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	108
PID 1616 wrote to memory of 4168	1616	7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe	108
PID 3104 wrote to memory of 2300	3104	Unicorn-6468.exe	109
PID 3104 wrote to memory of 2300	3104	Unicorn-6468.exe	109
PID 3104 wrote to memory of 2300	3104	Unicorn-6468.exe	109
PID 1532 wrote to memory of 3764	1532	Unicorn-32878.exe	110

C:\Users\Admin\AppData\Local\Temp\7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe
"C:\Users\Admin\AppData\Local\Temp\7640a31cb6665f1e8553160f409a5fc1ac74f927db3465daaf203fefb0821179N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5877.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53262.exe
        8⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5908.exe
        9⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        10⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        10⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17229.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        9⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
        8⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26418.exe
        9⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        9⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe
        8⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        9⤵
        
        PID:15920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48227.exe
        9⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        8⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8892.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        9⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3169.exe
        10⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        10⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        9⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
        9⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34896.exe
        8⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        8⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26467.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        8⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        8⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1064.exe
        8⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17207.exe
        7⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6624.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50330.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        8⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        9⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        9⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
        9⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        8⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        8⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57516.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48810.exe
        8⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        8⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        7⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        7⤵
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        8⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        8⤵
        
        PID:16572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37629.exe
        8⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        7⤵
        
        PID:15660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        6⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        8⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60671.exe
        8⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        7⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        6⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38353.exe
        6⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        8⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
        9⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
        9⤵
        
        PID:16400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32732.exe
        8⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe
        9⤵
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
        9⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        8⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        8⤵
        
        PID:17172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54341.exe
        7⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
        8⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36972.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5169.exe
        8⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
        7⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
        7⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        7⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        6⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25198.exe
        7⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        8⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        8⤵
        
        PID:16176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8101.exe
        8⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37689.exe
        7⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39126.exe
        7⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        7⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        7⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        7⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24705.exe
        6⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
        7⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        6⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        6⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29487.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        8⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        8⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        8⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48109.exe
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        7⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27755.exe
        7⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5524.exe
        6⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61238.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe
        8⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19062.exe
        8⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        7⤵
        
        PID:14280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        6⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47465.exe
        6⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        5⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58358.exe
        6⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        7⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46010.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12311.exe
        6⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        6⤵
        
        PID:14888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55816.exe
        5⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22379.exe
        6⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43136.exe
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15587.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57242.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6069.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        7⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 636
        8⤵
        Program crash
        
        PID:7156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 624
        7⤵
        Program crash
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5737.exe
        7⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        8⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8464.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
        7⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49874.exe
        8⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
        8⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
        7⤵
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        6⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        7⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46366.exe
        8⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        8⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63921.exe
        7⤵
        
        PID:13280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
        6⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43572.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21742.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        7⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        8⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        8⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43323.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51809.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        7⤵
        
        PID:13396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17200.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        7⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        7⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33757.exe
        7⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe
        6⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11972 -s 464
        7⤵
        Program crash
        
        PID:16728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15005.exe
        6⤵
        
        PID:11632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        6⤵
        
        PID:13432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46024.exe
        5⤵
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        5⤵
        
        PID:13804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        5⤵
        
        PID:12596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exe
        6⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        7⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        8⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
        8⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        8⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23028.exe
        7⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        7⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2482.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
        7⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27732.exe
        7⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38492.exe
        6⤵
        
        PID:10184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29957.exe
        6⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24481.exe
        6⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60309.exe
        6⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        7⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        7⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37629.exe
        7⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10095.exe
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51145.exe
        6⤵
        
        PID:15668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6047.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10356.exe
        6⤵
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62154.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27829.exe
        5⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        6⤵
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17207.exe
        5⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51371.exe
        5⤵
        
        PID:10624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46340.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        7⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        7⤵
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41926.exe
        7⤵
        
        PID:10076
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 596
        6⤵
        Program crash
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        5⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        6⤵
        
        PID:16744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16845.exe
        6⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26833.exe
        5⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30957.exe
        5⤵
        
        PID:10072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46628.exe
      4⤵
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2992.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        5⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
      4⤵
      PID:8672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        5⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23259.exe
      4⤵
      PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21726.exe
      4⤵
      PID:9608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47361.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exe
        5⤵
        Executes dropped EXE
        
        PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51741.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        6⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        7⤵
        
        PID:16688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8943.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
        6⤵
        
        PID:10864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        6⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        6⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exe
        6⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        6⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5872.exe
        5⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
        5⤵
        
        PID:12300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22523.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25826.exe
        6⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46210.exe
        8⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        8⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe
        8⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6500.exe
        7⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19623.exe
        7⤵
        
        PID:13832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61600.exe
        6⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        7⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58433.exe
        7⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5420.exe
        6⤵
        
        PID:13016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        6⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65462.exe
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        7⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        7⤵
        
        PID:16560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45989.exe
        7⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exe
        6⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23014.exe
        7⤵
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45295.exe
        7⤵
        
        PID:11376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        6⤵
        
        PID:15180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61060.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        6⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
        6⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        5⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        6⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        6⤵
        
        PID:12064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
        5⤵
        
        PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46837.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9105.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
        6⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        7⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
        7⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14105.exe
        7⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32401.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
        6⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33920.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        6⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        6⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
        5⤵
        
        PID:15204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63164.exe
      4⤵
      PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62442.exe
        5⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        6⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45221.exe
        5⤵
        
        PID:620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe
      4⤵
      PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45982.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        5⤵
        
        PID:12276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
      4⤵
      PID:11512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exe
      4⤵
      PID:10764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62876.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9473.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50034.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        6⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62442.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
        9⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-164.exe
        8⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44261.exe
        8⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        8⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        7⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20118.exe
        7⤵
        
        PID:528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        7⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
        7⤵
        
        PID:12128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        6⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42480.exe
        6⤵
        
        PID:15684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39694.exe
        6⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44584.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28596.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        7⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        7⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
        7⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        6⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41581.exe
        6⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        6⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        6⤵
        
        PID:11472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
        6⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11763.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe
        5⤵
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
        5⤵
        
        PID:11952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
        5⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26018.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        7⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        8⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7616.exe
        8⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exe
        8⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28264.exe
        7⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20200.exe
        7⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50449.exe
        6⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        7⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
        6⤵
        
        PID:14476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        6⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52229.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51150.exe
        6⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        7⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        7⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29652.exe
        7⤵
        
        PID:16424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        6⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
        5⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2800.exe
        5⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18684.exe
        5⤵
        
        PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
      4⤵
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19962.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58358.exe
        6⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
        7⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        7⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
        6⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44881.exe
        5⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5333.exe
        6⤵
        
        PID:14064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4433.exe
        6⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62472.exe
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24034.exe
        5⤵
        
        PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
      4⤵
      PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        5⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        6⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        5⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        5⤵
        
        PID:17232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
      4⤵
      PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65390.exe
        5⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        5⤵
        
        PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
      4⤵
      PID:13536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        5⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        7⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        8⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        8⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42118.exe
        7⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        6⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        5⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        6⤵
        
        PID:11360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        6⤵
        
        PID:16388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        6⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        5⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42480.exe
        5⤵
        
        PID:15692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46902.exe
        5⤵
        
        PID:10412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65337.exe
      4⤵
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        5⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        6⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
        7⤵
        
        PID:14716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59030.exe
        6⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
        5⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        6⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38972.exe
        5⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        5⤵
        
        PID:10040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6047.exe
      4⤵
      PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8685.exe
        5⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
        6⤵
        
        PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28700.exe
        5⤵
        
        PID:13264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57878.exe
        5⤵
        
        PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
      4⤵
      PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        5⤵
        
        PID:15508
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9336 -s 636
        5⤵
        Program crash
        
        PID:17252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
      4⤵
      PID:10708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52780.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
      4⤵
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56490.exe
        6⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        7⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36358.exe
        7⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27732.exe
        6⤵
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        5⤵
        
        PID:9856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        5⤵
        
        PID:15352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        5⤵
        
        PID:11128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
      4⤵
      PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
        5⤵
        
        PID:14088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
      4⤵
      PID:11576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32915.exe
      4⤵
      PID:16500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
    3⤵
    PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe
      4⤵
      PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        5⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        5⤵
        
        PID:16656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        5⤵
        
        PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
      4⤵
      PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61881.exe
      4⤵
      PID:4480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57062.exe
    3⤵
    PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
      4⤵
      PID:11328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        5⤵
        
        PID:15900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
      4⤵
      PID:16616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
      4⤵
      PID:7388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
    3⤵
    PID:10000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60492.exe
    3⤵
    PID:15040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6468.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6468.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32878.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        7⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14844.exe
        8⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        9⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
        9⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        8⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26833.exe
        8⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2348.exe
        8⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20518.exe
        9⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45295.exe
        9⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        8⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39815.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        7⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        8⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        7⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        7⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61253.exe
        6⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        7⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56874.exe
        8⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10356.exe
        8⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36882.exe
        8⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34896.exe
        7⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        8⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
        8⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        7⤵
        
        PID:13372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26851.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        7⤵
        
        PID:15232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
        7⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        6⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
        7⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16439.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
        6⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49022.exe
        6⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        8⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5525.exe
        9⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        9⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        8⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exe
        8⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
        8⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        8⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        7⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        7⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57516.exe
        6⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
        7⤵
        
        PID:14744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5420.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2515.exe
        6⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        5⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        6⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16766.exe
        8⤵
        
        PID:15516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12238.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        7⤵
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1648.exe
        6⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24034.exe
        6⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
        6⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        6⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46024.exe
        5⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        5⤵
        
        PID:13796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19214.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51061.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4948.exe
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        8⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        9⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        8⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
        8⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        7⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30936.exe
        7⤵
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        7⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
        8⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30525.exe
        8⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        7⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
        7⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        6⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3169.exe
        7⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        7⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15005.exe
        6⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33048.exe
        5⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        6⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17326.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        8⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
        8⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        8⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35716.exe
        7⤵
        
        PID:16512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3515.exe
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        6⤵
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54502.exe
        6⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38144.exe
        5⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        6⤵
        
        PID:13092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62154.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        5⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52428.exe
        5⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
        5⤵
        
        PID:9444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        5⤵
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe
        6⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        7⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        7⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58433.exe
        7⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        6⤵
        
        PID:10276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16764.exe
        6⤵
        
        PID:16456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57516.exe
        5⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        6⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe
        6⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        5⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
        5⤵
        
        PID:12776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
      4⤵
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        5⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        6⤵
        
        PID:16608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5148.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        5⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
        6⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        5⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51762.exe
        5⤵
        
        PID:12560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
      4⤵
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
        5⤵
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10356.exe
        5⤵
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        5⤵
        
        PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1476.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20214.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
      4⤵
      PID:14864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
      4⤵
      PID:8236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49141.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36992.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8699.exe
        6⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        7⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
        7⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57569.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        6⤵
        
        PID:15348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55071.exe
        6⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
        5⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61238.exe
        6⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        7⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        6⤵
        
        PID:13972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
        5⤵
        
        PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33802.exe
        5⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28596.exe
        6⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56298.exe
        7⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
        7⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        7⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        6⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58757.exe
        6⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3013.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        6⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14105.exe
        6⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        5⤵
        
        PID:14380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6614.exe
        5⤵
        
        PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25753.exe
      4⤵
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10356.exe
        6⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33949.exe
        6⤵
        
        PID:10776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        5⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        5⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
      4⤵
      PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        5⤵
        
        PID:16752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exe
        5⤵
        
        PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7480.exe
      4⤵
      PID:9212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39502.exe
      4⤵
      PID:15328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64796.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22510.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
        8⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16248.exe
        8⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28264.exe
        7⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
        6⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        7⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        7⤵
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
        7⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18839.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        6⤵
        
        PID:15468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47465.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        5⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
        6⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        7⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        6⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46394.exe
        6⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60884.exe
        5⤵
        
        PID:9012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5877.exe
        5⤵
        
        PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
      4⤵
      Executes dropped EXE
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        5⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59022.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        7⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
        7⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        7⤵
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        6⤵
        
        PID:820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55685.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        6⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        7⤵
        
        PID:16348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        6⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        5⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        5⤵
        
        PID:13700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59162.exe
        5⤵
        
        PID:9136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
      4⤵
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65322.exe
        5⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22379.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
        5⤵
        
        PID:13952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48175.exe
        5⤵
        
        PID:11800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
      4⤵
      PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        5⤵
        
        PID:13820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4433.exe
        5⤵
        
        PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
      4⤵
      PID:9108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55846.exe
      4⤵
      PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        5⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        7⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
        7⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37689.exe
        6⤵
        
        PID:17212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        6⤵
        
        PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        6⤵
        
        PID:11336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        6⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18839.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        5⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6069.exe
        5⤵
        
        PID:11740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16624.exe
      4⤵
      PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46905.exe
        5⤵
        
        PID:11556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
        5⤵
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44932.exe
      4⤵
      PID:9200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52866.exe
        5⤵
        
        PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
      4⤵
      PID:12564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47465.exe
      4⤵
      PID:3524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
    3⤵
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64118.exe
      4⤵
      PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
        5⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65146.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14957.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36136.exe
        5⤵
        
        PID:11584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41581.exe
        5⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
      4⤵
      PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        5⤵
        
        PID:15308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
      4⤵
      PID:10292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
      4⤵
      PID:15460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
      4⤵
      PID:12552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
      4⤵
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        5⤵
        
        PID:16160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
      4⤵
      PID:13568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
      4⤵
      PID:5376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
    3⤵
    PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
      4⤵
      PID:15828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exe
      4⤵
      PID:9792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23259.exe
    3⤵
    PID:13360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23890.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25810.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52914.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        7⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        8⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        9⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40826.exe
        9⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        8⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31149.exe
        8⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11684.exe
        7⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29009.exe
        7⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        6⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
        8⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        8⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6552.exe
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
        7⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        6⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42223.exe
        7⤵
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        6⤵
        
        PID:14372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29156.exe
        5⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17326.exe
        7⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        8⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        8⤵
        
        PID:16696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
        8⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41196.exe
        7⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
        7⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65301.exe
        6⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        7⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        7⤵
        
        PID:12152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        6⤵
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
        6⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46120.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51150.exe
        6⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        7⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        7⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
        7⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        6⤵
        
        PID:12528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        6⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44061.exe
        5⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59672.exe
        5⤵
        
        PID:11552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14614.exe
        5⤵
        
        PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45929.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exe
        5⤵
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
        6⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        7⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
        8⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        8⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
        8⤵
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
        7⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23028.exe
        6⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47267.exe
        7⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe
        6⤵
        
        PID:10744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
        5⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        6⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        5⤵
        
        PID:14924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        5⤵
        
        PID:9572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
      4⤵
      PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        5⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        6⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63086.exe
        7⤵
        
        PID:14268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3110.exe
        7⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        6⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2311.exe
        5⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51410.exe
        6⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        5⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51570.exe
        5⤵
        
        PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32333.exe
      4⤵
      PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23376.exe
        5⤵
        
        PID:15712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe
        5⤵
        
        PID:12144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59044.exe
      4⤵
      PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
      4⤵
      PID:14888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51716.exe
      4⤵
      PID:11884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55145.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51762.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        6⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64113.exe
        8⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37629.exe
        8⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
        7⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50094.exe
        7⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48824.exe
        6⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        7⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19830.exe
        7⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61093.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
        6⤵
        
        PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12037.exe
        6⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        7⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51669.exe
        6⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15383.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        5⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14237.exe
        5⤵
        
        PID:11992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
      4⤵
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64118.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-693.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        7⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
        7⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        6⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37689.exe
        6⤵
        
        PID:17228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46366.exe
        7⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        7⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2674.exe
        6⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        5⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55071.exe
        5⤵
        
        PID:12008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
      4⤵
      PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        5⤵
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60479.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        5⤵
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exe
        5⤵
        
        PID:11864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
      4⤵
      PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
      4⤵
      PID:12264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
      4⤵
      PID:8412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18631.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52914.exe
      4⤵
      PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14844.exe
        5⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        6⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        5⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        5⤵
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64206.exe
        5⤵
        
        PID:11252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
      4⤵
      PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60766.exe
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10356.exe
        5⤵
        
        PID:15124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4188.exe
        5⤵
        
        PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20811.exe
      4⤵
      PID:9544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22569.exe
      4⤵
      PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
    3⤵
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
      4⤵
      PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        5⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
        5⤵
        
        PID:14120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46810.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
      4⤵
      PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        5⤵
        
        PID:14436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        5⤵
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
      4⤵
      PID:15424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
      4⤵
      PID:10492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
    3⤵
    PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
      4⤵
      PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
        5⤵
        
        PID:11744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        5⤵
        
        PID:16420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28944.exe
      4⤵
      PID:12360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
      4⤵
      PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17428.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
      4⤵
      PID:16740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44790.exe
    3⤵
    PID:13588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
    3⤵
    PID:12056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64657.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64657.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36992.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32790.exe
        6⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
        7⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13885.exe
        8⤵
        
        PID:14376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8680 -s 544
        8⤵
        Program crash
        
        PID:7412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 740
        7⤵
        Program crash
        
        PID:10648
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5612 -s 532
        6⤵
        Program crash
        
        PID:9108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2992.exe
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe
        6⤵
        
        PID:14880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        6⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
        5⤵
        
        PID:10788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26852.exe
        5⤵
        
        PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6152.exe
      4⤵
      PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        6⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        6⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        6⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28264.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        5⤵
        
        PID:15256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56976.exe
      4⤵
      PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        5⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        5⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        5⤵
        
        PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
      4⤵
      PID:9840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61682.exe
      4⤵
      PID:1288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18426.exe
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36337.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36136.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5280.exe
        5⤵
        
        PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
      4⤵
      PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        5⤵
        
        PID:11396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18839.exe
      4⤵
      PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51410.exe
        5⤵
        
        PID:15840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        5⤵
        
        PID:10964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
      4⤵
      PID:15436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18684.exe
      4⤵
      PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
    3⤵
    PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
      4⤵
      PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10105.exe
        5⤵
        
        PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
      4⤵
      PID:13268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
    3⤵
    PID:6240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
    3⤵
    PID:8732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
    3⤵
    PID:10816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61996.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61996.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe
      4⤵
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        6⤵
        
        PID:16436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        6⤵
        
        PID:9416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        5⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3169.exe
        6⤵
        
        PID:15596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19830.exe
        6⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        5⤵
        
        PID:14184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        5⤵
        
        PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
      4⤵
      PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        5⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        5⤵
        
        PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
      4⤵
      PID:9732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
      4⤵
      PID:14960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38690.exe
      4⤵
      PID:7840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44584.exe
    3⤵
    PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
      4⤵
      PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17037.exe
        5⤵
        
        PID:11256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exe
      4⤵
      PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40206.exe
        5⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        5⤵
        
        PID:9472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
      4⤵
      PID:14392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
    3⤵
    PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53802.exe
      4⤵
      PID:8700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
      4⤵
      PID:12764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2059.exe
    3⤵
    PID:9356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49104.exe
    3⤵
    PID:13476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
    3⤵
    PID:8
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
      4⤵
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14393.exe
        5⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        6⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        6⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14964.exe
        5⤵
        
        PID:11976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7312.exe
        5⤵
        
        PID:16700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11684.exe
      4⤵
      PID:10568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
      4⤵
      PID:15388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63047.exe
      4⤵
      PID:10356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
      4⤵
      PID:10336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
      4⤵
      PID:16420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe
    3⤵
    PID:9712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
      4⤵
      PID:11824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
    3⤵
    PID:13620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3097.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3097.exe
  2⤵
  PID:3408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
    3⤵
    PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
      4⤵
      PID:10516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
      4⤵
      PID:4448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
    3⤵
    PID:11912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
    3⤵
    PID:16628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30737.exe
    3⤵
    PID:4972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47783.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47783.exe
  2⤵
  PID:6968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
    3⤵
    PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3169.exe
      4⤵
      PID:15744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exe
    3⤵
    PID:10704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7628.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7628.exe
  2⤵
  PID:2892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
  2⤵
  PID:12512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4824 -ip 4824
1⤵
PID:7640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5556 -ip 5556
1⤵
PID:7768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5612 -ip 5612
1⤵
PID:8880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5620 -ip 5620
1⤵
PID:10064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 7092 -ip 7092
1⤵
PID:12392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 9336 -ip 9336
1⤵
PID:17184

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 8680 -ip 8680
1⤵
PID:6496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe

Filesize
468KB

MD5
5fe6e49ca5e6d2e04ad51c8885d7eca3

SHA1
9af33ad613d23196d9398a908c45a593d23e47fc

SHA256
99054a5f7b400c5fa10c3b8af30ed13c9a2ae4c8803718ad46a6830846ab3e84

SHA512
bc1b5fb3a9891cb23f33bd737b1c91da1bfb3f6cb0677f5437419f7486593176ef2046891d1ad11e4400e0c0ddc76f7597bbbb37f385e3051100fa72024c5006

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe

Filesize
468KB

MD5
6ee855ed80bd261710632b4a9398a460

SHA1
87a462c4c4047519c307b47727042d12bb51caf5

SHA256
ad0d25a05c9fafae6b2cb57ebfbfd89f06132a9f684dcd278fe5e5f6c47a4083

SHA512
64650d18264ab32bd70b7b9717fdd1c16265e74a408996ab55f7e43778f9769994056f6b827b1361f795fe4bb78e3216992d8ae6f2727fe3c993a392f042429f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe

Filesize
468KB

MD5
67e54c66a825b4be5cd4e0f97e580ae2

SHA1
eda326d33f6c0cf451b811bcd3f0e1ed2298a8cb

SHA256
49088d77644d4ddfe580fe2a451377d93d0c8e4e7aae1ced44b5afc6121c205f

SHA512
3772ebe821f29841918aab7c5573a36d614636cf37e2edce18ff52c1657fc24593d2d9459ca08853136a044a79de4b05361f351dd07d3551feda25ef774902ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe

Filesize
468KB

MD5
beb0bdda254fb4b8abfaf6e6ac8aa898

SHA1
45fae941606aa558b623e53fa2054ec1a5a4371c

SHA256
6a3c822b450df87c9efe6a2963d0095203845670ba557a10a355108023d5fff2

SHA512
57ce80a0168d7eaffcc80440d432018a4c82771a47faa7ac6021ca32103e28d4f57d23ad362a0b1e11cee4e5d39427550972ab345e9e3de72913d0d8aad3fbbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe

Filesize
468KB

MD5
6e33ccf83ffde20e3a2a88b8721019cb

SHA1
3ecd9a8e005932e4dbcef362a50b5e8fd907cdd5

SHA256
ee19f95d2fbfc9b06594c6f59334cb27602d400c02d4c540d2d4f915882b18ff

SHA512
b0602ca9eaec94ab3c4020475cdc3ee9f068a6dcb09a3a64aaff9a8cdcd87d0f8f00bd2dc3dce4c97bc19ee77e21c432d1a9eca47abd07cbc466eb4cb0d2d0e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22523.exe

Filesize
468KB

MD5
689d62149bd6537744b82692365fad77

SHA1
d662f9542ccd44a95a62fdefd53782a27106e18b

SHA256
f0e4638770f93132e0a3b31058162a95ca0a65bafca6134870f0264bda5f2981

SHA512
67c126cfac2b3f15304666bab2014276f8499a8c472b95a794f4d868a2078e45150153587bfadece8a07ec06d922f5f4ed6016baeb75e44d3fbbc19d51f5c5c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23890.exe

Filesize
468KB

MD5
8431eb8974cb9645b52a3f2708647419

SHA1
7d41bdb644f027b283d2964fc2914b8e8bb91145

SHA256
b1036581558e0b398fc6ab7dd2408ccf234339a02e0a84cd4d91ded85f92d10d

SHA512
dcb87cf4e5e5edc215f26e6466b8c97a8666d14999943d3b80950cfdd9c35480d0c1c756d41a0d6f9c1b32a85c041311ac28d5bb3c591f2b7206507f6ace1a4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25810.exe

Filesize
468KB

MD5
5eaa699d781b1f3857e8f369e8d9b1c3

SHA1
b211871825c4274086d5d6616fdaae50a4d23ffd

SHA256
2dd1090dbb009d0f8ac27f11a6146a8a8ed520dd4297f9bde4048ed1df76c02f

SHA512
3b4ac38fd40fbbd3c07c6c5a8655e7e5cbb4f717b773ad579c1ec0d94071f8e2d1dd29c6d73b63fc9adcb79a0b26318cc4656e2de2aa47d8a4af20571afb6f1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exe

Filesize
468KB

MD5
bdcd969f40a5fafee257d5d4f97339ad

SHA1
440ff5af76613c348f19fb1792a1a25adcc0ff73

SHA256
fcf052e20d7296fc29ad4f983a87e558a5fe3b2634ebbdedb717fa54f76c85ca

SHA512
985c8a0dfd86ae6c029ea70c8d9c220eb0ee1839b8c4022b4063a63bed1fe2ed4fb155861173ae02f7432edaafac6bf8c70085b46e0770f7de4db6f1fef6531c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32878.exe

Filesize
468KB

MD5
05584af1b52737c516fb2d498a7ce3df

SHA1
bb2592753b2f1893279b55aef75e13d5dea16e21

SHA256
1ec3b329ae3def6f3c870b75b546a2ee14c4bc22c33056c6bd499ef65299b3a2

SHA512
598bc18952b2ce726c4838fa245fd27c5c3ec34ef438f0e8778ac898c3e605ebf6913d974f128dce6a68d4e1aeb916def2f385acf5458964b74732732813ece8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36992.exe

Filesize
468KB

MD5
4b6a0ecc3b36bc830be9aaa5f8c81489

SHA1
fcaa9261c0851f010b0ae45b7f0daee1841a7c97

SHA256
2f1a90b681fd45272de068a51f3cad8852b80cfe269ed1418a51641c92fc09a1

SHA512
b5d73b02703b72aef18e103e5d82dfed966d9ce098458bb4f09f4769e15f9bb2e02df2b68903f9efd9f2ab3e2d576a6632580339ac6cd9e5665801c4d46561e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe

Filesize
468KB

MD5
da97df3d3e65f38bd9d88782bafeba7b

SHA1
e9389df9ceebce547816ce4462b993e666d14415

SHA256
661b889dd4dbe9f83466f4b06ecfe75307724bbeabb2f59c05e45731a1e2f662

SHA512
f385c61df25afc892ddfcd6418428b84a2bdcd393237651e519eea94c38a1f140fcfb99039f63a7c412df9c0f6dda252ec47d28e00e26b02b71c343e8b1d95ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe

Filesize
468KB

MD5
612e9f2a55c5f2c1eb5bbe18d3181aea

SHA1
47c30a07ba0d091a2db6ffe61cc8d67f1492a31e

SHA256
2e822ccf63c60dd61843194689ae57610bef613d499ffbb2cdf9a89bbec7d157

SHA512
872c349f8df6f59f40f4df055fc0dc1f7ccde3f6ecd9528c29169faca067c3b91c1671100c1d05bac4a5f11d8db55fc8b9542c0806674793539a53acf4ae5d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47361.exe

Filesize
468KB

MD5
dfd125cfc0d72acb2e4b3310208c3d10

SHA1
6b19ea4f840ec80d428451781d4315e029b09b4e

SHA256
ee20dbaaf0737012fe079847cbc97864644ef833ab4b75f44b47ff53f8e193a5

SHA512
b8cf6d32e72cafa949d9cb6e9f06efb0c0dceca2aeaa836948d6c31a1a50393f6fc11a1a1bc9243636a65389d534eaa77c1146e577753f51aaf08243033b6388

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe

Filesize
468KB

MD5
2b559dd9ebf6e981679aa4833b28b394

SHA1
fc6331a5b556db63b63222928fa8c8ebbb8c50c3

SHA256
3304c0304dc78ac4ba6bb6ed5a112191cf00aaa347859c6be0909adb90129b80

SHA512
cea9cb27dd836afc110f2a7cdc7b0381c4859d9003b8443581ff756de75f59f1b2eb80570ef43626eab625243bea6dc895d9076ca1a78e3e5218a6ba91fda46e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49141.exe

Filesize
468KB

MD5
33decb563e31d2b314de68f08b31aa68

SHA1
10587482af889a7a7b92bdbc3ca15aa1e0e0d42b

SHA256
6a17e630ee80662dff4dd588efebe72eafe87afbbab1108743636f18201acd7d

SHA512
e5cd1f2680c137c1c304fa167d6e23893a4040de212fc15ba387d200230cb8f81649292406edd787bc63726ab6c5593d6340505fc6ecd007f2b389b008458c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe

Filesize
468KB

MD5
913b4868e32d04c1958025a52e4195a3

SHA1
9db2044efb23f0db1371edbaa009bd9cfa2c885e

SHA256
b15519fe58b0398e8d4b166dfe15e6f980694dce64feff8de1dc6ee447812526

SHA512
cbd8e156bd962051ab55d6359d5d1f83c5be5a5940352c509357a1a3bad56d4ef3e956bb13e1edd254656e6d96de28807bf609af5262ec51d02eddc7da02a24c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51061.exe

Filesize
468KB

MD5
93991562f6c312df8825f142d6886321

SHA1
872a3f6a75222b4a1f10a6006086fc7e64544b29

SHA256
0e4efbdeb7292ad8be7ab5aa67a29051f62c5383287ef47c743bd1c7488d7fbc

SHA512
1017c9906c2e17a0283f341b1b186bd41456317235f30afb8d42425f02ae1cb95ecc6cb66eb08d15024659542fdf2d4f5c8773fd366d86f96a20909dbd57f7de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55145.exe

Filesize
468KB

MD5
408d2e330c4d69e1ab91b9c453e7bb06

SHA1
21e0df7d8d701d2df2003855ebbdb8d8464afac7

SHA256
c28252c0fa9890fe330a1942ec66fcdf027492afa43e1d7897ce3ccf40adaac7

SHA512
7ed297dea9545c55fbd182ee8e0bace46827a812669a34a553e6ac2be0bbdc5db6da8b65194130dc64e74266c612b4cd090c0762198645ebdc47b4fd03e2aa7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57242.exe

Filesize
468KB

MD5
87e258579ca87f3f667fef27e032d5c3

SHA1
ec1cb5c239907d4e7f15acf0ee971e70b3052ded

SHA256
ad174efd12d925c8b33b0668e47e9768b58f2a302919d4d19090ca771917816e

SHA512
47184241a64210bae23f26552f7636ea5e3f88409361c997339c947ae4c4206ae8d5d3c7a19916fcdac30b1cde204f122a0b1cfa16c94c767353752a09467496

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5908.exe

Filesize
468KB

MD5
545be274a6992ed1b8083034ccc828b2

SHA1
c5e045ae64e08847507cc01d60246471c597b866

SHA256
d57a7592a869d5a3bf65736825d47264ca4348cdf7ce60347ad88b1384ef55a5

SHA512
a29d087541b7735a340c494a4f8b055a47ac97318f78c96f5da0d99121a44f4d7a85201995a2e9706cdaff0e4a7d49ad0931be5361a4ee3b4083c795372b81e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61996.exe

Filesize
468KB

MD5
51a9df85ba9c7d083c97afd931021652

SHA1
c1d672baeeb29cc6bce83299443f7207025dd6fa

SHA256
b2446ca7f2aec5a6f89bbc7a741daef283d1452abe7073ae6285abf00c7c6b73

SHA512
b436bfc3d52a722323770b0eb8f2d1764597979f2c5018b9511afe511da5a653d0ea3509e6131debfc3f855c0a4f096bdb30f3a4e0136c8d904d22947589b727

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe

Filesize
468KB

MD5
d3de8b2b23118f847f6e7840595719ce

SHA1
7c99b414bc5d284f8de3b85d3d3c2ea6ec9170d7

SHA256
5d3bc7894c21f94aaf6c1c2becf55120c51c217c3216a6ca10cb358922376f7a

SHA512
b2f76f39dbeb151e258c0bc980350d6c3dc445f4256271d52532633052d0dc1d3abd04e1b09f0a34d003607cefd52583bc5dc932364fd6e108b2e1182c8c2fcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62876.exe

Filesize
468KB

MD5
fafcce6e10f4ca7a4051736b561c95c4

SHA1
d71fa260d8c03c757c6802b706c82cd30cd83c98

SHA256
94bfe04ae59a83d5b33e54f34b6d3300bc731d258546f3e19ad7c5df89ad9fbf

SHA512
45cda8c9a2d72f55895b7067b6bfdc1139e6a6e7b2def6ad49e17266b33c49c09f6792196983557fb2aee42403020b983178f8336339b8b59b3a9a71c3531337

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe

Filesize
468KB

MD5
f219302969847a883d6202b5cae370de

SHA1
cbc375355a0423ee473a9efc2698b7b2bb3057ec

SHA256
5e4b9d6b2908434bd7f83fee87749a65b0c4fd540f0b784588fa9009228e01c9

SHA512
a7eb3318ddb883c87df6ce44e73122713deb13d3c1ad0ee5b3ebeaede37dc7b4fb0c2c7c4e7fb840d6ab7b181c662f4a8f37117211fadd8762d0eaacae67bf1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64657.exe

Filesize
468KB

MD5
8f662bbc8f524eec2f1b65ea59778a04

SHA1
573bdb2ac7dc2501572833d855fbff36cf079566

SHA256
51997cee722cf52e188f324c2da210736f1b40cdb4688e860f078cea6ca6dbaa

SHA512
06dcf920391639895207deeaae6e827eaa095b96a98aa3c1d320a64870aebfcd7dcb19551038f40056709c9fb1a502b01ba8ab36fc9c8e0847d04bdc3d7b57e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6468.exe

Filesize
468KB

MD5
4a68a7bf2ba539d79a1ce056c07e8ac9

SHA1
4244f4eece9cdf891b1233919204e69cd0dc9bb0

SHA256
d2341eb61fbb36e7690ea2a7d602107c54cb1d4097d3ce4d5e1492f581626795

SHA512
38b452f6c7fb058e4a28b032c88efbb94071b4a6c6243298d89ab6c2003011e96e483d7753b60a7b47402db5e8ee44c0118e50775d467c8d375514eca4a49b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64796.exe

Filesize
468KB

MD5
6b2fb6732a02229ddbd6891ad465e4cd

SHA1
0e600469d3db5007e7225d6263fec1f43dfb2778

SHA256
1176b9ab257a3f281f16dccd876c5a5842f1fe18ba410ed63f7b9de7fd5d9ede

SHA512
32378ea4b200939edfbc5f99e9af005b47ea208a17240db7b1311a69afcdbf8673c10606f90b49925307f89b95a07dfc09a0551b6c39aaf3494ebf1389532be1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe

Filesize
468KB

MD5
bcad8c2beebb3e4670f5bbbd6b55d5b1

SHA1
e9f383bed449df9521edfaf68348986990f7c341

SHA256
8e9baf4c59897d7ca750e0fbda0e494d7690106ea22a653c72f63010b044bf11

SHA512
6d323cc0eded09ee823d6f39b31680f4b7179adb7e0b453ad280d91aa8b91b4cc8f43ac167dcf5b5f8957984f0db1bd30aa28b3591ad3bc358e1c7d6a3549c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe

Filesize
468KB

MD5
b0277a60b2768fbc16c05b3e23a04a23

SHA1
2e04c2004ff03fd0e8167b36d4b889661ee5a947

SHA256
19ea0e0fc094a308639cb3a5137177d686c6ae7d0db7f1d0c034173189f141c1

SHA512
8e1feb9d2bae35cddaba0dd2863d95e1ba2e0b09be3f718357eb87f8df31c4bc3c4bfd5fc145597d5f4179d53e370913051a008b50088b4658328dcd77415d6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9473.exe

Filesize
468KB

MD5
21f330714530d8f5ae086a5a96a216b7

SHA1
8d127e112ad87e0a0be82b547db2d9106f5b6ac4

SHA256
78b8a7b07db9ff4783e6063e7d81a45dff4ab339813a24a7348758313d530c00

SHA512
a0f26dafd9ef08bf039fc274efbf8a0017c8d5f499d501ef9221a38ce8f7325081250e1a12bc6b09b5447b23631d2cf55a5c3803af412cfbd06874f0364454a7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads