4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29a

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe
Size

468KB
MD5

cd9cceaac321791cab1aa6c1bc0ee8d0
SHA1

b06898a086f5459dbee8ce85bfa9887b7ef59beb
SHA256

4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29a
SHA512

4cd499d59467bb638e6d5deb62ba16c2801e8e857a81697fb4f8055b8d39227210cca727b67dd04ee8ea23691c074df88915824c5264ed66b45bccbaa4ad004c
SSDEEP

3072:4beiogxiIU57tbYZPzcymbfD/n2DIsIH/QmyeQVqAu5skoi3u8ulj:4bDoqc7tCP4ymbfQa1wu5tP3u8

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3284	Unicorn-14648.exe
4752	Unicorn-32921.exe
1432	Unicorn-61379.exe
2164	Unicorn-58624.exe
5076	Unicorn-12952.exe
4808	Unicorn-12952.exe
2940	Unicorn-39687.exe
2504	Unicorn-24077.exe
1608	Unicorn-733.exe
636	Unicorn-19635.exe
4992	Unicorn-4559.exe
4020	Unicorn-54637.exe
2276	Unicorn-34771.exe
2808	Unicorn-17558.exe
1488	Unicorn-37159.exe
2540	Unicorn-3916.exe
3112	Unicorn-3916.exe
3032	Unicorn-49780.exe
4372	Unicorn-5955.exe
2904	Unicorn-55504.exe
4248	Unicorn-44212.exe
4796	Unicorn-31597.exe
4956	Unicorn-14383.exe
4220	Unicorn-14575.exe
2652	Unicorn-65037.exe
3184	Unicorn-47824.exe
4476	Unicorn-27958.exe
2688	Unicorn-12499.exe
4324	Unicorn-6221.exe
2856	Unicorn-9021.exe
1848	Unicorn-26234.exe
1172	Unicorn-38704.exe
720	Unicorn-35824.exe
2128	Unicorn-15958.exe
2024	Unicorn-30269.exe
4408	Unicorn-16534.exe
1660	Unicorn-4303.exe
4932	Unicorn-3946.exe
4748	Unicorn-26608.exe
2588	Unicorn-27376.exe
3080	Unicorn-62928.exe
4364	Unicorn-56990.exe
2420	Unicorn-58906.exe
4912	Unicorn-28371.exe
2608	Unicorn-7500.exe
4428	Unicorn-5554.exe
3612	Unicorn-50868.exe
2088	Unicorn-45267.exe
3876	Unicorn-5388.exe
2476	Unicorn-3250.exe
2536	Unicorn-5964.exe
2452	Unicorn-5964.exe
1548	Unicorn-5891.exe
2468	Unicorn-6156.exe
2828	Unicorn-54672.exe
2020	Unicorn-54672.exe
860	Unicorn-1728.exe
2160	Unicorn-7593.exe
4100	Unicorn-52190.exe
2704	Unicorn-38454.exe
3740	Unicorn-38454.exe
1592	Unicorn-38454.exe
4816	Unicorn-63063.exe
5016	Unicorn-41424.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
6404	5832	WerFault.exe	240
14912	7312	WerFault.exe	311
17092	7556	WerFault.exe	332
16840	7452	WerFault.exe	324
9896	7508	WerFault.exe	328
19608	7444	Process not Found	323

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29555.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	19208	Process not Found
Token: SeChangeNotifyPrivilege	19208	Process not Found
Token: 33	19208	Process not Found
Token: SeIncBasePriorityPrivilege	19208	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2432	4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe
3284	Unicorn-14648.exe
4752	Unicorn-32921.exe
1432	Unicorn-61379.exe
2164	Unicorn-58624.exe
5076	Unicorn-12952.exe
4808	Unicorn-12952.exe
2940	Unicorn-39687.exe
2504	Unicorn-24077.exe
1608	Unicorn-733.exe
4992	Unicorn-4559.exe
2808	Unicorn-17558.exe
636	Unicorn-19635.exe
2276	Unicorn-34771.exe
4020	Unicorn-54637.exe
1488	Unicorn-37159.exe
3112	Unicorn-3916.exe
2540	Unicorn-3916.exe
3032	Unicorn-49780.exe
4372	Unicorn-5955.exe
2904	Unicorn-55504.exe
4248	Unicorn-44212.exe
4956	Unicorn-14383.exe
4796	Unicorn-31597.exe
4324	Unicorn-6221.exe
4476	Unicorn-27958.exe
1848	Unicorn-26234.exe
2856	Unicorn-9021.exe
2652	Unicorn-65037.exe
4220	Unicorn-14575.exe
2688	Unicorn-12499.exe
3184	Unicorn-47824.exe
1172	Unicorn-38704.exe
2128	Unicorn-15958.exe
720	Unicorn-35824.exe
4408	Unicorn-16534.exe
2024	Unicorn-30269.exe
1660	Unicorn-4303.exe
4932	Unicorn-3946.exe
4748	Unicorn-26608.exe
2588	Unicorn-27376.exe
3080	Unicorn-62928.exe
4364	Unicorn-56990.exe
2420	Unicorn-58906.exe
4912	Unicorn-28371.exe
2608	Unicorn-7500.exe
4428	Unicorn-5554.exe
2088	Unicorn-45267.exe
3876	Unicorn-5388.exe
2476	Unicorn-3250.exe
3612	Unicorn-50868.exe
2452	Unicorn-5964.exe
2828	Unicorn-54672.exe
2468	Unicorn-6156.exe
2536	Unicorn-5964.exe
1548	Unicorn-5891.exe
1592	Unicorn-38454.exe
2020	Unicorn-54672.exe
860	Unicorn-1728.exe
2160	Unicorn-7593.exe
3740	Unicorn-38454.exe
2704	Unicorn-38454.exe
4100	Unicorn-52190.exe
4816	Unicorn-63063.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 3284	2432	4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe	86
PID 2432 wrote to memory of 3284	2432	4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe	86
PID 2432 wrote to memory of 3284	2432	4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe	86
PID 3284 wrote to memory of 4752	3284	Unicorn-14648.exe	87
PID 3284 wrote to memory of 4752	3284	Unicorn-14648.exe	87
PID 3284 wrote to memory of 4752	3284	Unicorn-14648.exe	87
PID 2432 wrote to memory of 1432	2432	4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe	88
PID 2432 wrote to memory of 1432	2432	4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe	88
PID 2432 wrote to memory of 1432	2432	4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe	88
PID 3284 wrote to memory of 2164	3284	Unicorn-14648.exe	89
PID 3284 wrote to memory of 2164	3284	Unicorn-14648.exe	89
PID 3284 wrote to memory of 2164	3284	Unicorn-14648.exe	89
PID 1432 wrote to memory of 5076	1432	Unicorn-61379.exe	90
PID 1432 wrote to memory of 5076	1432	Unicorn-61379.exe	90
PID 1432 wrote to memory of 5076	1432	Unicorn-61379.exe	90
PID 4752 wrote to memory of 4808	4752	Unicorn-32921.exe	91
PID 4752 wrote to memory of 4808	4752	Unicorn-32921.exe	91
PID 4752 wrote to memory of 4808	4752	Unicorn-32921.exe	91
PID 2432 wrote to memory of 2940	2432	4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe	92
PID 2432 wrote to memory of 2940	2432	4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe	92
PID 2432 wrote to memory of 2940	2432	4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe	92
PID 2164 wrote to memory of 2504	2164	Unicorn-58624.exe	93
PID 2164 wrote to memory of 2504	2164	Unicorn-58624.exe	93
PID 2164 wrote to memory of 2504	2164	Unicorn-58624.exe	93
PID 3284 wrote to memory of 1608	3284	Unicorn-14648.exe	94
PID 3284 wrote to memory of 1608	3284	Unicorn-14648.exe	94
PID 3284 wrote to memory of 1608	3284	Unicorn-14648.exe	94
PID 4808 wrote to memory of 636	4808	Unicorn-12952.exe	95
PID 4808 wrote to memory of 636	4808	Unicorn-12952.exe	95
PID 4808 wrote to memory of 636	4808	Unicorn-12952.exe	95
PID 5076 wrote to memory of 4992	5076	Unicorn-12952.exe	96
PID 5076 wrote to memory of 4992	5076	Unicorn-12952.exe	96
PID 5076 wrote to memory of 4992	5076	Unicorn-12952.exe	96
PID 2940 wrote to memory of 4020	2940	Unicorn-39687.exe	97
PID 2940 wrote to memory of 4020	2940	Unicorn-39687.exe	97
PID 2940 wrote to memory of 4020	2940	Unicorn-39687.exe	97
PID 4752 wrote to memory of 2276	4752	Unicorn-32921.exe	98
PID 4752 wrote to memory of 2276	4752	Unicorn-32921.exe	98
PID 4752 wrote to memory of 2276	4752	Unicorn-32921.exe	98
PID 1432 wrote to memory of 2808	1432	Unicorn-61379.exe	99
PID 1432 wrote to memory of 2808	1432	Unicorn-61379.exe	99
PID 1432 wrote to memory of 2808	1432	Unicorn-61379.exe	99
PID 2432 wrote to memory of 1488	2432	4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe	100
PID 2432 wrote to memory of 1488	2432	4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe	100
PID 2432 wrote to memory of 1488	2432	4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe	100
PID 2504 wrote to memory of 2540	2504	Unicorn-24077.exe	101
PID 2504 wrote to memory of 2540	2504	Unicorn-24077.exe	101
PID 2504 wrote to memory of 2540	2504	Unicorn-24077.exe	101
PID 1608 wrote to memory of 3112	1608	Unicorn-733.exe	102
PID 1608 wrote to memory of 3112	1608	Unicorn-733.exe	102
PID 1608 wrote to memory of 3112	1608	Unicorn-733.exe	102
PID 2164 wrote to memory of 3032	2164	Unicorn-58624.exe	103
PID 2164 wrote to memory of 3032	2164	Unicorn-58624.exe	103
PID 2164 wrote to memory of 3032	2164	Unicorn-58624.exe	103
PID 3284 wrote to memory of 4372	3284	Unicorn-14648.exe	104
PID 3284 wrote to memory of 4372	3284	Unicorn-14648.exe	104
PID 3284 wrote to memory of 4372	3284	Unicorn-14648.exe	104
PID 4992 wrote to memory of 2904	4992	Unicorn-4559.exe	105
PID 4992 wrote to memory of 2904	4992	Unicorn-4559.exe	105
PID 4992 wrote to memory of 2904	4992	Unicorn-4559.exe	105
PID 5076 wrote to memory of 4248	5076	Unicorn-12952.exe	106
PID 5076 wrote to memory of 4248	5076	Unicorn-12952.exe	106
PID 5076 wrote to memory of 4248	5076	Unicorn-12952.exe	106
PID 4020 wrote to memory of 4796	4020	Unicorn-54637.exe	107

C:\Users\Admin\AppData\Local\Temp\4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe
"C:\Users\Admin\AppData\Local\Temp\4cf4ef00f92fcff251d8fba002b592cf6362e487d35a2f26adc333da669ed29aN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14648.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14648.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5964.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33936.exe
        8⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
        9⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
        10⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48817.exe
        10⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        9⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        9⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17097.exe
        9⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8311.exe
        9⤵
        
        PID:17568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51156.exe
        8⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        9⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        9⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe
        8⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        8⤵
        
        PID:16808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50273.exe
        8⤵
        
        PID:18224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54256.exe
        8⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12495.exe
        9⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62129.exe
        9⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48817.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        8⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        8⤵
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62462.exe
        7⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41069.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe
        8⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
        8⤵
        
        PID:18188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        7⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        7⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        7⤵
        
        PID:18444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38454.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1263.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        8⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        9⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        9⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        8⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        8⤵
        
        PID:17272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47361.exe
        8⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23667.exe
        7⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        8⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        7⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        7⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23504.exe
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3433.exe
        8⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        8⤵
        
        PID:17184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-189.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        7⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37575.exe
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        6⤵
        
        PID:12916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        6⤵
        
        PID:18100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5964.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15212.exe
        7⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54707.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        9⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8688.exe
        9⤵
        
        PID:16848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54186.exe
        9⤵
        
        PID:18032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        8⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        8⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34198.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        8⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
        8⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64712.exe
        8⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6054.exe
        7⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
        7⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        8⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60951.exe
        8⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54216.exe
        8⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        7⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        7⤵
        
        PID:18736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        6⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41171.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        7⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53914.exe
        7⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        6⤵
        
        PID:11556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        6⤵
        
        PID:17316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
        6⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        6⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24464.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
        8⤵
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44904.exe
        8⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20390.exe
        7⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe
        7⤵
        
        PID:18020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        6⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5481.exe
        7⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56456.exe
        7⤵
        
        PID:18168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        6⤵
        
        PID:15508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24375.exe
        6⤵
        
        PID:18852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1574.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        8⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46065.exe
        8⤵
        
        PID:18208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        7⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35112.exe
        7⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13056.exe
        6⤵
        
        PID:15808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
        6⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46457.exe
        5⤵
        
        PID:11212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
        5⤵
        
        PID:15708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-879.exe
        5⤵
        
        PID:8452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6156.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        8⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        9⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
        9⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        9⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        8⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13056.exe
        8⤵
        
        PID:15744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        8⤵
        
        PID:18592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58611.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15744.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
        7⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18313.exe
        7⤵
        
        PID:16876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59649.exe
        7⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10045.exe
        6⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59955.exe
        8⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        7⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48817.exe
        7⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
        6⤵
        
        PID:17420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38454.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
        6⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39056.exe
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        8⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        8⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63985.exe
        8⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        7⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        7⤵
        
        PID:18620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34198.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exe
        7⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41561.exe
        7⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3600.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
        6⤵
        
        PID:16064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        6⤵
        
        PID:17820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
        6⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        7⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
        7⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        7⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        6⤵
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12454.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        6⤵
        
        PID:18920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        5⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
        5⤵
        
        PID:10552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55578.exe
        5⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40184.exe
        5⤵
        
        PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5388.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        6⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3433.exe
        8⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        8⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        7⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51265.exe
        7⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41946.exe
        7⤵
        
        PID:18660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35763.exe
        6⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43441.exe
        7⤵
        
        PID:17468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        6⤵
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        6⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56528.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53873.exe
        7⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22704.exe
        7⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22960.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe
        6⤵
        
        PID:15552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
        6⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20928.exe
        5⤵
        
        PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        5⤵
        
        PID:15332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        5⤵
        
        PID:17400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45236.exe
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
        6⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53914.exe
        6⤵
        
        PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        5⤵
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        5⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        5⤵
        
        PID:18536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exe
      4⤵
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        6⤵
        
        PID:18052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        5⤵
        
        PID:13448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exe
        5⤵
        
        PID:16388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1593.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7855.exe
        5⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62449.exe
        5⤵
        
        PID:632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
      4⤵
      PID:10848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51880.exe
      4⤵
      PID:16600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
      4⤵
      PID:6000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58624.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63063.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        8⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        9⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        9⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        9⤵
        
        PID:16428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54330.exe
        9⤵
        
        PID:18184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        8⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59955.exe
        9⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27872.exe
        8⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53914.exe
        8⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7855.exe
        8⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35112.exe
        8⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
        7⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40721.exe
        7⤵
        
        PID:16488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
        7⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        6⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56528.exe
        8⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12719.exe
        9⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17737.exe
        9⤵
        
        PID:19008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        8⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43441.exe
        8⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        7⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28576.exe
        7⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30545.exe
        7⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37700.exe
        6⤵
        
        PID:8580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26317.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe
        6⤵
        
        PID:17604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59405.exe
        6⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27024.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        8⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
        9⤵
        
        PID:14368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7452 -s 600
        9⤵
        Program crash
        
        PID:16840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        8⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        8⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18681.exe
        8⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        8⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
        8⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        7⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
        7⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
        6⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
        8⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        8⤵
        
        PID:17328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48817.exe
        8⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25277.exe
        7⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        7⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52286.exe
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        6⤵
        
        PID:12464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40721.exe
        6⤵
        
        PID:16436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64874.exe
        6⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        5⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61226.exe
        7⤵
        
        PID:13628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        6⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        7⤵
        
        PID:16848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3750.exe
        6⤵
        
        PID:16700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        6⤵
        
        PID:18940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10726.exe
        5⤵
        
        PID:5832
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 632
        6⤵
        Program crash
        
        PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        5⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        5⤵
        
        PID:12436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-559.exe
        5⤵
        
        PID:18092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41616.exe
        6⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42675.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56560.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        9⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60951.exe
        9⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        9⤵
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7254.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58200.exe
        8⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41971.exe
        8⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
        8⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        7⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63690.exe
        7⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exe
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49345.exe
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        7⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        7⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60471.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        6⤵
        
        PID:18512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        5⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1458.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        7⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
        8⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25277.exe
        7⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        7⤵
        
        PID:17080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:17624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        5⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
        6⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62826.exe
        7⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        7⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        7⤵
        
        PID:17928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
        5⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe
        6⤵
        
        PID:14928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50602.exe
        6⤵
        
        PID:19064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        5⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37737.exe
        5⤵
        
        PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12783.exe
        5⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51920.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
        8⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56008.exe
        8⤵
        
        PID:18840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51265.exe
        7⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28433.exe
        7⤵
        
        PID:18688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        6⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4914.exe
        7⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37664.exe
        7⤵
        
        PID:19124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32119.exe
        6⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
        6⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        7⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50977.exe
        7⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57367.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        6⤵
        
        PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe
        5⤵
        
        PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32394.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46968.exe
        5⤵
        
        PID:16704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
      4⤵
      PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        6⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59955.exe
        7⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe
        6⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        6⤵
        
        PID:17828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe
        5⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        6⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        5⤵
        
        PID:16932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18176.exe
        5⤵
        
        PID:18348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64526.exe
      4⤵
      PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        5⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        5⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20583.exe
        5⤵
        
        PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15603.exe
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
      4⤵
      PID:14528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43905.exe
      4⤵
      PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41424.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23952.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        8⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
        8⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exe
        8⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54327.exe
        7⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21271.exe
        7⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        7⤵
        
        PID:18628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
        6⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        7⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        7⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62552.exe
        7⤵
        
        PID:16648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
        7⤵
        
        PID:17908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39911.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        6⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        6⤵
        
        PID:17636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39539.exe
        5⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27024.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7855.exe
        8⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16263.exe
        8⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
        7⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        7⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        7⤵
        
        PID:18584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
        6⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47434.exe
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51258.exe
        7⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
        7⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
        6⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
        7⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        6⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14642.exe
        7⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        7⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
        7⤵
        
        PID:18668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39032.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
        6⤵
        
        PID:15616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        6⤵
        
        PID:17648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55364.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        5⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37144.exe
        5⤵
        
        PID:18200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59405.exe
        5⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        6⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        8⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8441.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2777.exe
        7⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23667.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        6⤵
        
        PID:13500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40641.exe
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48666.exe
        5⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        6⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        7⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
        7⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
        7⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38209.exe
        6⤵
        
        PID:17120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8112.exe
        6⤵
        
        PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8050.exe
        5⤵
        
        PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57691.exe
      4⤵
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        6⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
        7⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55319.exe
        7⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22567.exe
        7⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        5⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48817.exe
        6⤵
        
        PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        5⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        5⤵
        
        PID:16860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe
        5⤵
        
        PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49166.exe
      4⤵
      PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17587.exe
        5⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37075.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        6⤵
        
        PID:13700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14137.exe
        5⤵
        
        PID:14064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49393.exe
        5⤵
        
        PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
      4⤵
      PID:9672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4303.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4086.exe
        5⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        6⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11785.exe
        7⤵
        
        PID:16164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7508 -s 688
        7⤵
        Program crash
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37568.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        5⤵
        
        PID:9692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exe
        5⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
        5⤵
        
        PID:18256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
      4⤵
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
        7⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        7⤵
        
        PID:17940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe
        6⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14217.exe
        6⤵
        
        PID:18136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        5⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16179.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
        6⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        6⤵
        
        PID:18896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
        5⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37473.exe
        5⤵
        
        PID:16868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        5⤵
        
        PID:18456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
      4⤵
      PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        5⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32752.exe
        5⤵
        
        PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
      4⤵
      PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14320.exe
      4⤵
      PID:14424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22528.exe
      4⤵
      PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3946.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42384.exe
      4⤵
      PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27024.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
        7⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        7⤵
        
        PID:17840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39032.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
        6⤵
        
        PID:16664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35584.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
        5⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31897.exe
        6⤵
        
        PID:17116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4439.exe
        5⤵
        
        PID:11956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
        5⤵
        
        PID:376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
      4⤵
      PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21322.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        6⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        6⤵
        
        PID:18564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2224.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exe
        5⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
        5⤵
        
        PID:18576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49982.exe
      4⤵
      PID:8564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
      4⤵
      PID:11836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40721.exe
      4⤵
      PID:16596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
      4⤵
      PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36409.exe
    3⤵
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
      4⤵
      PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        5⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
        6⤵
        
        PID:11388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        6⤵
        
        PID:16836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62481.exe
        6⤵
        
        PID:18124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        5⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8311.exe
        5⤵
        
        PID:17528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
      4⤵
      PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7680.exe
      4⤵
      PID:12756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
      4⤵
      PID:17448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
    3⤵
    PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
      4⤵
      PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14345.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63985.exe
      4⤵
      PID:932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41672.exe
    3⤵
    PID:10136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39816.exe
    3⤵
    PID:12996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27680.exe
    3⤵
    PID:18352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61875.exe
        7⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        8⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        9⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        10⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        10⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61226.exe
        9⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
        8⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        8⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59681.exe
        8⤵
        
        PID:18112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58775.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7788.exe
        8⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45345.exe
        9⤵
        
        PID:18964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15382.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        8⤵
        
        PID:17920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe
        7⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15014.exe
        7⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3645.exe
        7⤵
        
        PID:16064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        6⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5900.exe
        7⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3433.exe
        9⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41561.exe
        9⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
        9⤵
        
        PID:18648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        8⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23475.exe
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        7⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        7⤵
        
        PID:18004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
        8⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7312 -s 684
        8⤵
        Program crash
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1648.exe
        7⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe
        7⤵
        
        PID:18040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58151.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24787.exe
        7⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58675.exe
        6⤵
        
        PID:18148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22451.exe
        8⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        9⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61098.exe
        9⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exe
        8⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
        8⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37338.exe
        8⤵
        
        PID:19136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe
        7⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        7⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
        7⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46826.exe
        6⤵
        
        PID:15172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18176.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        5⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54707.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4688.exe
        7⤵
        
        PID:17200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        6⤵
        
        PID:15440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22071.exe
        6⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52455.exe
        5⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21322.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
        6⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        6⤵
        
        PID:16916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        6⤵
        
        PID:18392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33968.exe
        5⤵
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27513.exe
        5⤵
        
        PID:16040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        5⤵
        
        PID:19076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27376.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61875.exe
        6⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27402.exe
        9⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52234.exe
        9⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16560.exe
        8⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56026.exe
        8⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1395.exe
        7⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31226.exe
        7⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48894.exe
        6⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19562.exe
        7⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
        7⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43658.exe
        6⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27126.exe
        5⤵
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        6⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        7⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        7⤵
        
        PID:17360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
        7⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        6⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47361.exe
        6⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26781.exe
        5⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63341.exe
        6⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36784.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61098.exe
        7⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19705.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-615.exe
        5⤵
        
        PID:14352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        5⤵
        
        PID:17536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56990.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42736.exe
        6⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54609.exe
        6⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11165.exe
        5⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13545.exe
        5⤵
        
        PID:12740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53130.exe
        5⤵
        
        PID:17956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
      4⤵
      PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39056.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        6⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4464.exe
        7⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12960.exe
        7⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26617.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19440.exe
        6⤵
        
        PID:17556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21203.exe
        5⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18745.exe
        5⤵
        
        PID:344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45134.exe
      4⤵
      PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        5⤵
        
        PID:12716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62449.exe
        5⤵
        
        PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15603.exe
      4⤵
      PID:10228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1145.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19640.exe
      4⤵
      PID:17436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17558.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14383.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7500.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51123.exe
        6⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5132.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        8⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        8⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        8⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29009.exe
        8⤵
        
        PID:18720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        7⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        7⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        7⤵
        
        PID:16940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        7⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39720.exe
        7⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64257.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18176.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60884.exe
        5⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56077.exe
        6⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        7⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        7⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        7⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        6⤵
        
        PID:528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        6⤵
        
        PID:15424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47934.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        6⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27434.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
        5⤵
        
        PID:14464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        5⤵
        
        PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53427.exe
        5⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59825.exe
        7⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58484.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58200.exe
        6⤵
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34841.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exe
        6⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39987.exe
        7⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5369.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        6⤵
        
        PID:17580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        5⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32394.exe
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
        5⤵
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
      4⤵
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        5⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
        6⤵
        
        PID:16468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7556 -s 608
        6⤵
        Program crash
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60273.exe
        5⤵
        
        PID:11564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        5⤵
        
        PID:17260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2777.exe
        5⤵
        
        PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58151.exe
      4⤵
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
      4⤵
      PID:12400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58675.exe
      4⤵
      PID:18176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39120.exe
        5⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exe
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
        6⤵
        
        PID:12248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-176.exe
        6⤵
        
        PID:18868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        5⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37738.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        6⤵
        
        PID:16856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe
        5⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
      4⤵
      PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52036.exe
        6⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39032.exe
        5⤵
        
        PID:11768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        5⤵
        
        PID:15368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59681.exe
        5⤵
        
        PID:18104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62462.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55347.exe
        5⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50858.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
      4⤵
      PID:11788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3721.exe
      4⤵
      PID:3152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50957.exe
      4⤵
      PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        5⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30960.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        6⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        6⤵
        
        PID:740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7833.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64993.exe
        5⤵
        
        PID:14844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        5⤵
        
        PID:17592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
      4⤵
      PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
      4⤵
      PID:10912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
      4⤵
      PID:15464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
      4⤵
      PID:18600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe
    3⤵
    PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
      4⤵
      PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        5⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
        5⤵
        
        PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
      4⤵
      PID:11924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57825.exe
      4⤵
      PID:15988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15097.exe
      4⤵
      PID:5564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
    3⤵
    PID:8368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
    3⤵
    PID:12556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11928.exe
    3⤵
    PID:16604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22125.exe
        6⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        8⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        8⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        8⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18745.exe
        7⤵
        
        PID:17544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48894.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59955.exe
        7⤵
        
        PID:12536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44746.exe
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        6⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        6⤵
        
        PID:18528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
        5⤵
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        6⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
        7⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        7⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26570.exe
        6⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        6⤵
        
        PID:18484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34611.exe
        6⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19545.exe
        6⤵
        
        PID:15348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        6⤵
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
        5⤵
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        5⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52493.exe
        5⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7478.exe
        6⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57073.exe
        7⤵
        
        PID:16400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        6⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        6⤵
        
        PID:17968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53591.exe
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
        6⤵
        
        PID:12768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32944.exe
        6⤵
        
        PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        5⤵
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        5⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
        6⤵
        
        PID:14968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19449.exe
        6⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        5⤵
        
        PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        5⤵
        
        PID:15408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        5⤵
        
        PID:18952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exe
      4⤵
      PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        5⤵
        
        PID:12576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51473.exe
      4⤵
      PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26512.exe
      4⤵
      PID:17340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47891.exe
      4⤵
      PID:17020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50957.exe
        5⤵
        
        PID:208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        6⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58416.exe
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        7⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4921.exe
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35027.exe
        6⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        6⤵
        
        PID:13424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe
        6⤵
        
        PID:16580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        5⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
        6⤵
        
        PID:14084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        5⤵
        
        PID:12304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29481.exe
        5⤵
        
        PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47511.exe
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3600.exe
        6⤵
        
        PID:18800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        5⤵
        
        PID:15920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
        5⤵
        
        PID:18760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
      4⤵
      PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12338.exe
        5⤵
        
        PID:11100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
        5⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        5⤵
        
        PID:18556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
      4⤵
      PID:13072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18809.exe
      4⤵
      PID:1268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42480.exe
        6⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exe
        6⤵
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-432.exe
        6⤵
        
        PID:16192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35027.exe
        5⤵
        
        PID:9276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        5⤵
        
        PID:13440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
        5⤵
        
        PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
      4⤵
      PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5481.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        5⤵
        
        PID:17756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54849.exe
      4⤵
      PID:11524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32119.exe
      4⤵
      PID:468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64231.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        5⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8688.exe
        5⤵
        
        PID:16840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22153.exe
        5⤵
        
        PID:17148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
      4⤵
      PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
      4⤵
      PID:15468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53208.exe
      4⤵
      PID:18816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63214.exe
    3⤵
    PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49811.exe
      4⤵
      PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
      4⤵
      PID:16100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
      4⤵
      PID:18640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62161.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-889.exe
    3⤵
    PID:16216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
    3⤵
    PID:18932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1071.exe
        5⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28237.exe
        6⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47827.exe
        7⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24409.exe
        7⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        7⤵
        
        PID:18548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46682.exe
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
        6⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37338.exe
        6⤵
        
        PID:19052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        5⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57776.exe
        6⤵
        
        PID:14580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64618.exe
        6⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        5⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50273.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10045.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
        5⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35112.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
      4⤵
      PID:13568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43264.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38454.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46925.exe
      4⤵
      PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8044.exe
        5⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21098.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        6⤵
        
        PID:13704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58481.exe
        6⤵
        
        PID:18296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        5⤵
        
        PID:10368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55297.exe
        5⤵
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61873.exe
        5⤵
        
        PID:18828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
      4⤵
      PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
        5⤵
        
        PID:12652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17737.exe
        5⤵
        
        PID:19020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
      4⤵
      PID:11580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
      4⤵
      PID:4104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
    3⤵
    PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exe
      4⤵
      PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55319.exe
        5⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        5⤵
        
        PID:18708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39032.exe
      4⤵
      PID:11576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
      4⤵
      PID:16308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58145.exe
      4⤵
      PID:18212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55364.exe
    3⤵
    PID:8036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
    3⤵
    PID:11588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
      4⤵
      PID:18308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
    3⤵
    PID:3780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6221.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6221.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5554.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7215.exe
      4⤵
      PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        6⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22538.exe
        7⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        6⤵
        
        PID:10904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        6⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        6⤵
        
        PID:18472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        5⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        5⤵
        
        PID:12968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
        5⤵
        
        PID:404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37913.exe
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63341.exe
        5⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22960.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        6⤵
        
        PID:16656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        5⤵
        
        PID:12832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        5⤵
        
        PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
      4⤵
      PID:9304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26544.exe
      4⤵
      PID:13640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
      4⤵
      PID:18612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
    3⤵
    PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9580.exe
      4⤵
      PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62906.exe
        5⤵
        
        PID:15328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50922.exe
        5⤵
        
        PID:17516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
      4⤵
      PID:9916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13056.exe
      4⤵
      PID:15700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
      4⤵
      PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50555.exe
    3⤵
    PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33968.exe
      4⤵
      PID:10728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
      4⤵
      PID:17192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15865.exe
      4⤵
      PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
    3⤵
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47121.exe
    3⤵
    PID:16292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12329.exe
    3⤵
    PID:19040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25197.exe
    3⤵
    PID:848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10991.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        5⤵
        
        PID:12372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        5⤵
        
        PID:17304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
      4⤵
      PID:9332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13056.exe
      4⤵
      PID:15828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
      4⤵
      PID:18676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48894.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41069.exe
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2041.exe
      4⤵
      PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62152.exe
      4⤵
      PID:16024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38721.exe
    3⤵
    PID:2372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5927.exe
    3⤵
    PID:15388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3808.exe
    3⤵
    PID:18748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exe
  2⤵
  PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
    3⤵
    PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
      4⤵
      PID:12980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31897.exe
      4⤵
      PID:17088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39032.exe
    3⤵
    PID:11520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
    3⤵
    PID:16160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49857.exe
    3⤵
    PID:552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38661.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38661.exe
  2⤵
  PID:8164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33939.exe
    3⤵
    PID:9908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24409.exe
    3⤵
    PID:15516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28785.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28785.exe
  2⤵
  PID:11780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe
  2⤵
  PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5832 -ip 5832
1⤵
PID:8512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7312 -ip 7312
1⤵
PID:14516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 7556 -ip 7556
1⤵
PID:17080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe

Filesize
468KB

MD5
3a37c81a510ba3aef709728058351d29

SHA1
76d4cc1aff6dffd3ad1fc106af0c05e2739d4e16

SHA256
8e66a503db2433e646f2e2eb190943296d209c7864a459c4d2bbd44dd1cd68d1

SHA512
89eedf104c80507c4d29101b4babe3511d7e71d894a94cbca3a7eb950c04c83facb4a770c746d94270a951256d11203c6b60f17505fdfa4bc408376642eab046

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe

Filesize
468KB

MD5
27651711e084fa02507828bb6542e5a9

SHA1
9fed67022824bd45ca94d86e5bdd884a4e78a1a0

SHA256
2407b965f571ed85e836a8f6c22aae34949242b7286a4775c04cf619ccb308de

SHA512
532405a586739557e17f45d87b7741eff9864a95fe3a66462cb0cdce0bf07f893236737b80f489bfffe69d85cff316fdeb5d76c5e068b121445b43f5e784434b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14383.exe

Filesize
468KB

MD5
af99eab6d484f07657485b3fba75859a

SHA1
df4f31676b1898d4f0ff3a39ed123159824951fe

SHA256
152977eae33cba9986efbde48606b931573b3fc8fa50b39b4cc291ac2c5d5842

SHA512
7605c7e90a229ffb91cfe4978cc92ff5b1749fc67a41014c77a2f16f51d25efcfcd2af769896dbcf3327a41a5dc6f812614652d7a1935b53b6cfead25c732eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe

Filesize
468KB

MD5
574d8d84782d53eebb02a9a13d074122

SHA1
27f30618700df381327b56702600036da769553e

SHA256
4e97b6bb0ed728cc7d5b69afdaeed966f9f8d2ea8ad8f8c3db02ccc4311e8207

SHA512
27dc990ddc4895474bb900765666ff5f137285ef28b7ff7edd984ec53afb72cb3efd3e04b34ec62e16a76d46cc84d30a60f6b256dc972b0c6f724d3fc4c36895

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14648.exe

Filesize
468KB

MD5
1c147ebf68ccf3cf3f3db79e9bc18af6

SHA1
cad06798cb6876c2c102fbe2abf51c45330be00c

SHA256
ddb834498e475ccabbe38643ff7770d75577692d48d8cc49cfb403e8d4a745be

SHA512
25d8c1b4dd2bf9753772b79deecbe163217bf8f32883b3437ecd14f649f8408ec886b4feb7947b332189ccb09c1298976b112e2301095dc69c441d020fedc1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe

Filesize
468KB

MD5
a7ea5cb951ae6da1c359d48b203aea85

SHA1
22f0987316fc7d0f56eeb42834637395a4099ec6

SHA256
9ab793a02d771471fda560b194c9c32e2afd6dcaa7311125e3d0951bccca4e37

SHA512
ad302c7313de560556c2749815e0a5f0d73158c819b2474da8e3d19474fc678f928a3becf6b863b7fefabbfa32b1cd3a1eb160db5cbb1e05d65f68b4716b91b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17558.exe

Filesize
468KB

MD5
3f20ea386622fd4c529022cc711c24e0

SHA1
9da00f9105ae06df3d0508cc118d3f790dc19ebc

SHA256
de73a2945de0af2cc1133c509d17c8632b7ac7373809df83e34489e67d9acafe

SHA512
6929eaf7a0bcd880e3275748ed5041d69e5f4e491d741c69c4fc142a2a025975070fe2b8dba3d6d9db43d07222b27a2c7325dbc07f10315c3cf90802f4d6d9ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe

Filesize
468KB

MD5
521539a77e22dc95a7e9c580d74568ba

SHA1
da390776c4750586e3df733b870958f64f171049

SHA256
447a2d973659b15644be335decd36fcba70d9c026351945b51a0e113c6c5b570

SHA512
ef6ffeb70c3948040889ef27a52185a4bb6d63a4434d2543338097495d74f14a7c56027ceff1134acbeefe1feaa9f3b4d3671c25576b5f5909f27a7338ffdd0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe

Filesize
468KB

MD5
88c4328a747a914b32f67e895947d657

SHA1
c1e3a5fde1500e0f10b7a43d92ed59d741f425fb

SHA256
9f81fdc0d321803894f3073bcf64e64e2339cd0cba54c90a5604015ac5b67ac0

SHA512
93ab94d1795348286071274dd4f42b56bb7ded1fab5c912f8041252f459dc6f18f76826fb5c54906d5384243cba59a3539ebb9c348b6247ff26dbabd51dcbe36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe

Filesize
468KB

MD5
3855a4e57def5e23732b00c98059dcf0

SHA1
826ab56c829d3ac7f62af243dde38e5b1670ff85

SHA256
4e3e27cf3cb85e9e30ab46e9d911460fcb0745721f52325742f700cd5707ca10

SHA512
36927d6302d3ead67a5299b96adbbdcb5be0e5c3d0aed075df2210344d39e172f62329d0b0e3bcf32b776d717bbba051eef9bad63375e8e7599ee16f97dc3e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe

Filesize
468KB

MD5
50cb4d376046db38935c9309166803a9

SHA1
a6371bdba271aba1557f595a08915bd96dc0fb1e

SHA256
3c04f38e5c23a7a6f74d428605575213d69f0b455778d86ce90ccc79ede56841

SHA512
de03d921f0260b383a00fe64f97d1a4178f155c894adbcdcb3e3796bc1831c17391ec5fb64970e30f9d64d00912ead93e73af473ce3725c89ec6107783e4f68e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe

Filesize
468KB

MD5
48017376626c07d44aaa23e5b47e7b01

SHA1
4724b9d4312dadfc3464897c7777f3b393c70b14

SHA256
7bcabb5edd7755c87d96cc2670730af95e1b68d1ccfb2935b9d6737f24170d98

SHA512
aa537e708c3bf5f1f766bde3ec82a8ec85a993a3065d9bcae124e87e978e23de631fa7afe90c322956f9d9a526c7bcbf8821ad7a18de78d57c28b4291acf97e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe

Filesize
468KB

MD5
5ab7b5aadb76658309a1af6e32b3b63a

SHA1
2666551b81bbe24398ddceb99828fce6b85a050e

SHA256
6429ec0d6fe5493a5750c4bab398b4e8114f5f0e9a92d113d6b03ae0f9e7cd38

SHA512
d9f97a2992ee379643c4df51ee3cf1b0e0103f8e86f888184f82b0de6cda59e3561f62a6302079ac49f16a709708967a43a2e80f21aef62966ac9d1be2baf619

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33936.exe

Filesize
468KB

MD5
b543590e3e9eb008b41f4c8efb01e05b

SHA1
499a6e2a4e2b4884b466917a911dcfcf06697e42

SHA256
7ebf0c41c33e772a54cbd24c613aa0b180e1c01f369e035950000dda5f43086c

SHA512
b3c2b68331367a08a8668c8fbeb2e81c9d70903d1661c18bc1d6c3a56c35f536e3ea85ccc4e297dbeb5f4a2b092596c8b33d4bad19f7e1262136a68b08f549eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe

Filesize
468KB

MD5
e97da006c345c8a1a19e78a1016eb698

SHA1
8c2a74c4b5e54b106fbe5b26f058f32ea020583d

SHA256
85b272f428cf0933c481e051ac3934b36b619c605dd436cadd6d099e21a55133

SHA512
5434d4494661a755a972a515323d86510478895f1609dbcf657ab0487b3008b51975d2bd8b58bb4d448e59577ef037fce01579c41aa8d8938042a9760a3d99bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe

Filesize
468KB

MD5
3425eff3e80a1f57793a9542a60d4c11

SHA1
7e8e84238b51f1546a4d8b79871b6f73b36d8bab

SHA256
1620191a4bc7a4c92e3d314fc5649a669ce137af88855d86da12716eed019623

SHA512
5eafc5e1ceb5ac5e4d58ae1ca71ed135cdb84343026954b1d450869b78d450cf96fb992b4e33271a9e5f5836254275a23cd161b0483da6ebdef8b5e3055154e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe

Filesize
468KB

MD5
7aa6b9ad47c2a4aba11c418bf29e90a0

SHA1
cdbd3958fa87be690db454daf0f554ed207e2775

SHA256
48f582d1ff3f3c8121973d630b55583539fe7f656ba7d535424e0854c07f6260

SHA512
54e00c0dad28f51d484a6be6ce068a5fbfcbca9c85b21e4d7bfb531ad3f77b6738bc630b897f53f46ebd827e4f342833b8b170ddb1e75d70421d2d213f3ba0d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe

Filesize
468KB

MD5
1ca889c1cf1676b746bef662616643fe

SHA1
a7f20ef9b3214381df7c95f324fe52cb6f7dec83

SHA256
5c70f5f8cbbc5a4baef3f0e5a7ffc9720ca242c1ea35bb39d645786ee9cd97a3

SHA512
2515937ec99abecf2e3ab466ee94775fb70968678e32bf40580ade5015b4b71a548375e8681f11cd234162223f539e9d601e0381a711d00feac1393fc94cf7c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe

Filesize
468KB

MD5
4f0a4fb1b6a255fecb7368953a5d99e0

SHA1
9b09d222047d85d8fcf78263e9a37fcf6c04223a

SHA256
7b14e5ebcfc26bf2cbcf64f0edf6132116b79a028060e589217ecdac18bfa271

SHA512
8a1a90e8e63f5ab31b8518958e2970cfbd7ab21e2e7d53bab234798848aa8394f412abe337c0d0ab87f576c02281f7e0cf6b3e21bab3425a6e179d8f108a6158

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe

Filesize
468KB

MD5
da79dbaaae1baa0164ff910a70367171

SHA1
0f38b310e773e8cb4dad5a79545f5a95ff84cd05

SHA256
b9cfd18010f98c63013a13c07b2ad300fb6b7179995bce1ab7123ae19d731edb

SHA512
f0071ea061b0af58bed23aadebe423a98fd4cc806af9fb83b65c3a5cc995a79babb85e547205b1a8c44865bcb36d21979793a5928d715ee7774f9068c56cfcf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe

Filesize
468KB

MD5
1fb72f43763a54104fc91729e8244961

SHA1
f7c3aa74d8afacf8ceaadb7349c258e2ad8780e2

SHA256
c65d809f57f16aac2013d7eb7087fd8c7a62a2e54d7f01a199be79e15e556473

SHA512
56ddd3ebc7f33a488fac718f74118b4f851b0d68982d27edc998b98f1671873d0f9fe9d08a1df32bccf487d2fdf99c55fcabe73ca43ba3ff73b9fbadd753424e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe

Filesize
468KB

MD5
c5f852d93769f19a7c0ee5ada7878e25

SHA1
10c3ee361743463f436d4c996602c0099a8886cc

SHA256
fa3a5f81e0589979c3bcd3e555865911766e64d1b72a2eafcbc8cfbc86446abf

SHA512
95913737bdf7b40bd13a7b8d2669ff7df04fe2c865ba29bcb69f35352dc564425a0d37b4107ee82dea37aea3ce5e6cc454059d325efb7b7771044aac997f20ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe

Filesize
468KB

MD5
40077d56fcc26e3bab67cf7dee0add61

SHA1
71dac468b54236905e26bba8893da950ada7600e

SHA256
03530d2c7929757ac2a0c60bb6329167223b14494ef025cfebc7f0a0b4e34f3d

SHA512
3e85da3ab77c5e48b064a6bbc5d524ea712f99caca9566e65cc8856c079f1453d87a83fac022d0bc71db2022dc677f3e2f797ae5b58efd2c146008d01834c8a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe

Filesize
468KB

MD5
155a75170af3a72a8db270e8a4ce8183

SHA1
2c9620d336696da430234418b96edff47f976002

SHA256
e6634eb8861a7fe5a2dffd0d5be17d4041344bee4111514560b2ba7eab462e64

SHA512
544210eb0cfb32e046f7175e77e84ab29b8f587608a33201ec7cc36ed0fcfaa7c10503431171fb2c9a897b3ae5080d45badb161d46667ba1276afacbcafd294e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe

Filesize
468KB

MD5
9bf8ec768348e2d54ae956a445865a42

SHA1
cc7212126808857fbb19776c7aff2bc00a273631

SHA256
19d996028b46115912818309c71ddf9f42e43a38583cf8d9ebb0372944892e65

SHA512
5e8a85475e2c9b4596d719f38b0292fce3d8b426ffafe86cac015d4e93551d5d48b077edafbb082317246b1183fb1cad9645a919b1e892754a029507d6889765

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe

Filesize
468KB

MD5
99b003531a5a2778969b1610ca2e718a

SHA1
2821825cddafe27d43d3737ddb3792c0bf8b3553

SHA256
5cfb1ee08e67c98c9b2be8fe0091fdd38ecee1760573ad0d549c06d65b8690a8

SHA512
5df80c264d07b963857921ea389cf2ed856e84e91878ab5d81002ead9e43242ae1b9ce045167eab33c3d21c3ae7f31360d0d71111d46e8a58b2768088660e59e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58624.exe

Filesize
468KB

MD5
86bd6ca7d880bac56bbb6409e58350db

SHA1
147affa01892f0b431776dcd07178f1a08e2503e

SHA256
e9b41e7b7dd0440f323313341ac0ec395a0571e82caa3c50bca3d0ed90cb983d

SHA512
0b36d6d337a57db3893deba6700027cfbfe0b474317b21636da5689e7fbeb81a15e0cb96ff1f7fbe029c8c746ec65d4d130d5971ec98009311f52fc03c2fe4c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe

Filesize
468KB

MD5
2b1a0cd7b67ca224fdc07b7b13a7b99e

SHA1
81a376f82f2844ae78ac399e38a2598389523f2c

SHA256
707bd20a6b905a19abbeda0c6cbbaf4a50712b9ff2db218289d72e184ef8c7a2

SHA512
0717d688672b3593e85e6e33b214d60fa37cb544b19c285cba80f0650aecebde0439cb743325058dc3d60d358369a13a425f2a8c032fe3142f5983e1ae2365de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe

Filesize
468KB

MD5
b7605371b9de7bdabd13418a0c10bea7

SHA1
6258206226fde68895aa4526190e4cf28cc60ba8

SHA256
741fa38bfdadd3283fdee75b3f3500113693b926d0463e6466385c5d45bb0f9c

SHA512
770fcc2c143ee083741a5ada2eec799e0428b684c63de2ea250405d88d02aa4ffc24f08f58026c7a6e62981b96a64a8774e432f31910fa61fd97feef51ebfbe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6221.exe

Filesize
468KB

MD5
ceb7a5b677715d048444e0b5c5f4bcda

SHA1
b2779080b786b072cae9bb3e540beedac7eceac8

SHA256
a67bc96b836b6f2215486342c3f90dad672e2e74a8c1104e9e562b630d7c76f7

SHA512
02dbdaaa9ecd811725e7fc165007e31c091e6ca2fecd79bb6b41d7811f5afc39a8cc15dd7a198abb2d989e55256e76cae0ee9945a4ff4196845742c3d82f67b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe

Filesize
468KB

MD5
09f62dcd6f2aadaad6c0c04eaa75ec25

SHA1
8c86531b72573165db3ab1e21a53ed279cb9039b

SHA256
aafef9dd99adb16b21404bd9bf3607dad168e32f5a9455af342b9db494afb71a

SHA512
6aa476f6f3914c78bc656af5ddf6e93d0d6ab1371f101cd903d70f30aaa411e5157e85761312b468a135e6ae6b50fd67576ae16dd0919c7f13d752eb2de5da66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe

Filesize
468KB

MD5
81f5e922f82eef7b80823016f74652a7

SHA1
098b60f97cb4a1bccb688925a425d9a7f71fcebd

SHA256
3f02f00aa35dba64009783964cf0059153fc1665ea2c3529b6093e23e35e97c6

SHA512
501353b16e6a0e174ab60602b0a8a2bc6be7656b1052dd567e7a5fb8cfda841244a3f28b6c2a63749932181485ed3de706d07cafc3a633990244d36ad3dc5019

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe

Filesize
468KB

MD5
b35a2f927cd8332484ac365abc4ad9a9

SHA1
63746900f13dec81aaaf4ebe0bf6d33638819ad5

SHA256
06049c1e4d094978fef1b388d427098c12ecb18785375619ec1fcff9ef7ce4e8

SHA512
ad3e31a6c90b7885c49edbfb59744f8482fcdc770d311b3a7aa126d18a8fa286d07fe3b752a8d5cb2d05b3e0db8ec2cdbd88b8cf6cf3ae1dba1f759e48d6b7f3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads