d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7

Analysis

max time kernel
137s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe
Size

184KB
MD5

0c3bf3ad4853271d1ebdc98602244cd0
SHA1

bc2b1a38b9a360047f32621d32a32f6d10697798
SHA256

d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7
SHA512

114008c44bf415d9823f2934caedf9a6e86e266630c64b6f4f60114ea4ce01c072232fc5486d28426461edb149fe1fb87cec1cb9c4c2d463bff356dec2503a30
SSDEEP

3072:x2o9MkonrwWodHoZW0ec8saQ9lvnqnxiuh:x2Oo5UHoh8fQ9lPqnxiu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3484	Unicorn-12445.exe
2320	Unicorn-28494.exe
2832	Unicorn-41300.exe
3084	Unicorn-25495.exe
3864	Unicorn-8644.exe
5068	Unicorn-61566.exe
3832	Unicorn-6235.exe
1172	Unicorn-15646.exe
452	Unicorn-28068.exe
2324	Unicorn-15069.exe
4568	Unicorn-64462.exe
4688	Unicorn-58332.exe
2168	Unicorn-27684.exe
4616	Unicorn-47285.exe
2368	Unicorn-13533.exe
116	Unicorn-46590.exe
4140	Unicorn-46590.exe
980	Unicorn-13725.exe
3220	Unicorn-30062.exe
1708	Unicorn-55806.exe
2352	Unicorn-10134.exe
3808	Unicorn-4004.exe
4808	Unicorn-10134.exe
804	Unicorn-55806.exe
1704	Unicorn-26340.exe
1972	Unicorn-37275.exe
3624	Unicorn-40076.exe
4500	Unicorn-62277.exe
2852	Unicorn-31505.exe
628	Unicorn-31505.exe
2052	Unicorn-16238.exe
3244	Unicorn-44997.exe
4436	Unicorn-61333.exe
4296	Unicorn-861.exe
1488	Unicorn-49989.exe
2804	Unicorn-17390.exe
1840	Unicorn-33342.exe
4912	Unicorn-56885.exe
3660	Unicorn-40940.exe
464	Unicorn-669.exe
1948	Unicorn-17006.exe
3412	Unicorn-39105.exe
1636	Unicorn-51912.exe
1280	Unicorn-33166.exe
2476	Unicorn-39297.exe
4796	Unicorn-19431.exe
2888	Unicorn-55633.exe
2920	Unicorn-22504.exe
4864	Unicorn-22769.exe
636	Unicorn-18855.exe
2204	Unicorn-65263.exe
3228	Unicorn-5856.exe
3672	Unicorn-19047.exe
1668	Unicorn-38913.exe
3224	Unicorn-49119.exe
3200	Unicorn-26254.exe
1648	Unicorn-1632.exe
3668	Unicorn-31159.exe
4632	Unicorn-31159.exe
2372	Unicorn-18161.exe
3944	Unicorn-47989.exe
2388	Unicorn-1248.exe
4724	Unicorn-28174.exe
2952	Unicorn-34305.exe

Program crash 32 IoCs

pid	pid_target	Process	procid_target
5048	3832	WerFault.exe	92
5460	3228	WerFault.exe	140
5288	3228	WerFault.exe	140
6512	3104	WerFault.exe	188
6676	1916	WerFault.exe	186
7912	3104	WerFault.exe	188
8100	1916	WerFault.exe	186
8956	6272	WerFault.exe	268
8928	6256	WerFault.exe	267
6776	3428	WerFault.exe	189
9404	4224	WerFault.exe	193
10844	3672	WerFault.exe	142
11024	6256	WerFault.exe	267
11092	3428	WerFault.exe	189
9284	6068	WerFault.exe	247
12652	7072	WerFault.exe	323
6432	6324	WerFault.exe	273
13304	6068	WerFault.exe	247
14684	3220	WerFault.exe	108
15020	7072	WerFault.exe	323
15012	6324	WerFault.exe	273
16708	5240	WerFault.exe	254
17308	6148	WerFault.exe	260
17348	6308	WerFault.exe	271
17376	3220	WerFault.exe	108
17976	6356	WerFault.exe	277
3176	6332	WerFault.exe	274
18232	4168	WerFault.exe	185
16544	16908	WerFault.exe	884
2180	2380	WerFault.exe	259
20424	2380	Process not Found	259
14400	4616	Process not Found	1340

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
7804	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18420	dwm.exe
Token: SeChangeNotifyPrivilege	18420	dwm.exe
Token: 33	18420	dwm.exe
Token: SeIncBasePriorityPrivilege	18420	dwm.exe
Token: SeCreateGlobalPrivilege	10652	Process not Found
Token: SeChangeNotifyPrivilege	10652	Process not Found
Token: 33	10652	Process not Found
Token: SeIncBasePriorityPrivilege	10652	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1484	d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe
3484	Unicorn-12445.exe
2320	Unicorn-28494.exe
2832	Unicorn-41300.exe
3084	Unicorn-25495.exe
3864	Unicorn-8644.exe
3832	Unicorn-6235.exe
5068	Unicorn-61566.exe
1172	Unicorn-15646.exe
2324	Unicorn-15069.exe
452	Unicorn-28068.exe
4568	Unicorn-64462.exe
4616	Unicorn-47285.exe
4688	Unicorn-58332.exe
2168	Unicorn-27684.exe
116	Unicorn-46590.exe
2368	Unicorn-13533.exe
4140	Unicorn-46590.exe
1972	Unicorn-37275.exe
3808	Unicorn-4004.exe
4808	Unicorn-10134.exe
1708	Unicorn-55806.exe
3220	Unicorn-30062.exe
2352	Unicorn-10134.exe
980	Unicorn-13725.exe
4500	Unicorn-62277.exe
3624	Unicorn-40076.exe
804	Unicorn-55806.exe
1704	Unicorn-26340.exe
628	Unicorn-31505.exe
2852	Unicorn-31505.exe
2052	Unicorn-16238.exe
3244	Unicorn-44997.exe
4436	Unicorn-61333.exe
4296	Unicorn-861.exe
1488	Unicorn-49989.exe
2804	Unicorn-17390.exe
1840	Unicorn-33342.exe
4912	Unicorn-56885.exe
3660	Unicorn-40940.exe
464	Unicorn-669.exe
1636	Unicorn-51912.exe
3412	Unicorn-39105.exe
1948	Unicorn-17006.exe
2920	Unicorn-22504.exe
2476	Unicorn-39297.exe
2888	Unicorn-55633.exe
4864	Unicorn-22769.exe
1280	Unicorn-33166.exe
636	Unicorn-18855.exe
2204	Unicorn-65263.exe
3228	Unicorn-5856.exe
4796	Unicorn-19431.exe
3224	Unicorn-49119.exe
1668	Unicorn-38913.exe
3672	Unicorn-19047.exe
3200	Unicorn-26254.exe
1648	Unicorn-1632.exe
3668	Unicorn-31159.exe
4632	Unicorn-31159.exe
2372	Unicorn-18161.exe
3944	Unicorn-47989.exe
2952	Unicorn-34305.exe
2948	Unicorn-60847.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 3484	1484	d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe	86
PID 1484 wrote to memory of 3484	1484	d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe	86
PID 1484 wrote to memory of 3484	1484	d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe	86
PID 3484 wrote to memory of 2320	3484	Unicorn-12445.exe	87
PID 3484 wrote to memory of 2320	3484	Unicorn-12445.exe	87
PID 3484 wrote to memory of 2320	3484	Unicorn-12445.exe	87
PID 1484 wrote to memory of 2832	1484	d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe	88
PID 1484 wrote to memory of 2832	1484	d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe	88
PID 1484 wrote to memory of 2832	1484	d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe	88
PID 2320 wrote to memory of 3084	2320	Unicorn-28494.exe	89
PID 2320 wrote to memory of 3084	2320	Unicorn-28494.exe	89
PID 2320 wrote to memory of 3084	2320	Unicorn-28494.exe	89
PID 3484 wrote to memory of 3864	3484	Unicorn-12445.exe	90
PID 3484 wrote to memory of 3864	3484	Unicorn-12445.exe	90
PID 3484 wrote to memory of 3864	3484	Unicorn-12445.exe	90
PID 2832 wrote to memory of 5068	2832	Unicorn-41300.exe	91
PID 2832 wrote to memory of 5068	2832	Unicorn-41300.exe	91
PID 2832 wrote to memory of 5068	2832	Unicorn-41300.exe	91
PID 1484 wrote to memory of 3832	1484	d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe	92
PID 1484 wrote to memory of 3832	1484	d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe	92
PID 1484 wrote to memory of 3832	1484	d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe	92
PID 3084 wrote to memory of 1172	3084	Unicorn-25495.exe	93
PID 3084 wrote to memory of 1172	3084	Unicorn-25495.exe	93
PID 3084 wrote to memory of 1172	3084	Unicorn-25495.exe	93
PID 2320 wrote to memory of 452	2320	Unicorn-28494.exe	94
PID 2320 wrote to memory of 452	2320	Unicorn-28494.exe	94
PID 2320 wrote to memory of 452	2320	Unicorn-28494.exe	94
PID 3864 wrote to memory of 2324	3864	Unicorn-8644.exe	95
PID 3864 wrote to memory of 2324	3864	Unicorn-8644.exe	95
PID 3864 wrote to memory of 2324	3864	Unicorn-8644.exe	95
PID 5068 wrote to memory of 4568	5068	Unicorn-61566.exe	96
PID 5068 wrote to memory of 4568	5068	Unicorn-61566.exe	96
PID 5068 wrote to memory of 4568	5068	Unicorn-61566.exe	96
PID 3484 wrote to memory of 4688	3484	Unicorn-12445.exe	97
PID 3484 wrote to memory of 4688	3484	Unicorn-12445.exe	97
PID 3484 wrote to memory of 4688	3484	Unicorn-12445.exe	97
PID 2832 wrote to memory of 2168	2832	Unicorn-41300.exe	100
PID 2832 wrote to memory of 2168	2832	Unicorn-41300.exe	100
PID 2832 wrote to memory of 2168	2832	Unicorn-41300.exe	100
PID 1484 wrote to memory of 4616	1484	d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe	99
PID 1484 wrote to memory of 4616	1484	d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe	99
PID 1484 wrote to memory of 4616	1484	d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe	99
PID 1172 wrote to memory of 2368	1172	Unicorn-15646.exe	104
PID 1172 wrote to memory of 2368	1172	Unicorn-15646.exe	104
PID 1172 wrote to memory of 2368	1172	Unicorn-15646.exe	104
PID 2324 wrote to memory of 116	2324	Unicorn-15069.exe	105
PID 2324 wrote to memory of 116	2324	Unicorn-15069.exe	105
PID 2324 wrote to memory of 116	2324	Unicorn-15069.exe	105
PID 452 wrote to memory of 4140	452	Unicorn-28068.exe	106
PID 452 wrote to memory of 4140	452	Unicorn-28068.exe	106
PID 452 wrote to memory of 4140	452	Unicorn-28068.exe	106
PID 4568 wrote to memory of 980	4568	Unicorn-64462.exe	107
PID 4568 wrote to memory of 980	4568	Unicorn-64462.exe	107
PID 4568 wrote to memory of 980	4568	Unicorn-64462.exe	107
PID 4616 wrote to memory of 3220	4616	Unicorn-47285.exe	108
PID 4616 wrote to memory of 3220	4616	Unicorn-47285.exe	108
PID 4616 wrote to memory of 3220	4616	Unicorn-47285.exe	108
PID 3864 wrote to memory of 1708	3864	Unicorn-8644.exe	109
PID 3864 wrote to memory of 1708	3864	Unicorn-8644.exe	109
PID 3864 wrote to memory of 1708	3864	Unicorn-8644.exe	109
PID 2168 wrote to memory of 2352	2168	Unicorn-27684.exe	110
PID 2168 wrote to memory of 2352	2168	Unicorn-27684.exe	110
PID 2168 wrote to memory of 2352	2168	Unicorn-27684.exe	110
PID 4688 wrote to memory of 4808	4688	Unicorn-58332.exe	112

C:\Users\Admin\AppData\Local\Temp\d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe
"C:\Users\Admin\AppData\Local\Temp\d560c309cd2c4405b4407b173695c01af286fdcac9e79b09303fc9cf47af4aa7.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64398.exe
        9⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        10⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        11⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2318.exe
        11⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23128.exe
        11⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        10⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48447.exe
        10⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
        10⤵
        
        PID:17120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        9⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45441.exe
        10⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        10⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        10⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        9⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exe
        9⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        9⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        8⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        9⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        9⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        9⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55588.exe
        9⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        8⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3920.exe
        9⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20135.exe
        9⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        9⤵
        
        PID:18124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        9⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        8⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21262.exe
        8⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52577.exe
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        9⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        9⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        9⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8711.exe
        8⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24737.exe
        9⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62943.exe
        8⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42424.exe
        8⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exe
        8⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46639.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        8⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21361.exe
        9⤵
        
        PID:16416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        8⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60104.exe
        8⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        8⤵
        
        PID:18340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        8⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exe
        7⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
        7⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe
        7⤵
        
        PID:18052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44997.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1248.exe
        7⤵
        Executes dropped EXE
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12800.exe
        8⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55745.exe
        9⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
        8⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42424.exe
        8⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64271.exe
        8⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        8⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        7⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        7⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43367.exe
        7⤵
        
        PID:16200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
        6⤵
        Executes dropped EXE
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        8⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        9⤵
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        9⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        8⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8708.exe
        8⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16884.exe
        7⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
        7⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        7⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        7⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29521.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
        8⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        8⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        7⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42424.exe
        7⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47359.exe
        7⤵
        
        PID:18144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29054.exe
        6⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
        7⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        7⤵
        
        PID:18236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11052.exe
        7⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18615.exe
        6⤵
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9488.exe
        6⤵
        
        PID:15104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        8⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        8⤵
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        8⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27953.exe
        8⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        8⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        8⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exe
        8⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        7⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        6⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        7⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        8⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        8⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6148 -s 624
        8⤵
        Program crash
        
        PID:17308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
        7⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        7⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        7⤵
        
        PID:16916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22622.exe
        6⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36705.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        7⤵
        
        PID:17544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27662.exe
        6⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        6⤵
        
        PID:17672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49119.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exe
        6⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7424.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39249.exe
        8⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7079.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        7⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20135.exe
        7⤵
        
        PID:16724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
        6⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
        7⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        7⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
        7⤵
        
        PID:16908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        6⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
        6⤵
        
        PID:14208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        6⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27128.exe
        5⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
        7⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55320.exe
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10286.exe
        6⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6103.exe
        6⤵
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
        6⤵
        
        PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        5⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9984.exe
        6⤵
        
        PID:13052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3335.exe
        6⤵
        
        PID:17140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        5⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        5⤵
        
        PID:14996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26718.exe
        5⤵
        
        PID:18388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        9⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7006.exe
        8⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2631.exe
        8⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
        8⤵
        
        PID:18348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38959.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        7⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
        7⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        7⤵
        
        PID:17876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        8⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59233.exe
        9⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        9⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        9⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13623.exe
        8⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe
        8⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe
        8⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        8⤵
        
        PID:18268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-576.exe
        8⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        8⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        7⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        7⤵
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30686.exe
        6⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        8⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        8⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52271.exe
        8⤵
        
        PID:17588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
        7⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39736.exe
        7⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29180.exe
        7⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        7⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
        7⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25342.exe
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe
        6⤵
        
        PID:14324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5746.exe
        6⤵
        
        PID:18196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26254.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26286.exe
        7⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        7⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        7⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        6⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        7⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        7⤵
        
        PID:17332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        6⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
        6⤵
        
        PID:17604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
        5⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        6⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 604
        7⤵
        Program crash
        
        PID:8928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 604
        7⤵
        Program crash
        
        PID:11024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        6⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        6⤵
        
        PID:16924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36158.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        6⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26487.exe
        5⤵
        
        PID:9660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5206.exe
        5⤵
        
        PID:18392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4004.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe
        6⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37585.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46350.exe
        8⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60753.exe
        9⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        8⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8708.exe
        8⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61009.exe
        8⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        8⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52271.exe
        8⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4039.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        7⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6772.exe
        7⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62001.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11616.exe
        8⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        8⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
        8⤵
        
        PID:18136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        7⤵
        
        PID:14040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
        6⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        7⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47752.exe
        7⤵
        
        PID:17572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        7⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24325.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21454.exe
        6⤵
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64984.exe
        5⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23361.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
        8⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        8⤵
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64952.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        7⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe
        7⤵
        
        PID:18304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
        6⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        6⤵
        
        PID:15120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55972.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-894.exe
        5⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4352.exe
        6⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        7⤵
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        7⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
        6⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60438.exe
        6⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
        5⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        5⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        5⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        5⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24897.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
        7⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
        7⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
        7⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42519.exe
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37409.exe
        6⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8071.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        6⤵
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59903.exe
        5⤵
        
        PID:16256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61996.exe
      4⤵
      PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        6⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22369.exe
        7⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        7⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        7⤵
        
        PID:18360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exe
        6⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        6⤵
        
        PID:15976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
        5⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48335.exe
        5⤵
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
        5⤵
        
        PID:14328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45516.exe
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24615.exe
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        5⤵
        
        PID:11564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        5⤵
        
        PID:15888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3070.exe
        5⤵
        
        PID:17640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13175.exe
        5⤵
        
        PID:408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
      4⤵
      PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16582.exe
      4⤵
      PID:13436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8644.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16238.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18161.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
        8⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        9⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45441.exe
        10⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14375.exe
        10⤵
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47109.exe
        10⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32087.exe
        9⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17435.exe
        9⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe
        8⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        9⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
        8⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        8⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16183.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12800.exe
        8⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-0.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-0.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        8⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39736.exe
        8⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3159.exe
        8⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        8⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64911.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43816.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        7⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        7⤵
        
        PID:17944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        8⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39089.exe
        9⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        9⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37095.exe
        8⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24254.exe
        8⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        8⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        7⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41121.exe
        8⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        8⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
        8⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18692.exe
        7⤵
        
        PID:15092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31454.exe
        6⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        8⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        8⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        8⤵
        
        PID:16712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40120.exe
        7⤵
        
        PID:15228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        6⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        7⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        7⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
        7⤵
        
        PID:16616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        7⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
        6⤵
        
        PID:14752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15600.exe
        6⤵
        
        PID:17980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34305.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54113.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58993.exe
        9⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3335.exe
        9⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
        8⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40591.exe
        8⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17543.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        8⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23511.exe
        8⤵
        
        PID:17444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
        7⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3584.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        8⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        7⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exe
        7⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        7⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        7⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
        7⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        7⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
        6⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2622.exe
        6⤵
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exe
        6⤵
        
        PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        7⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32673.exe
        8⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        8⤵
        
        PID:17248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29783.exe
        7⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
        6⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        7⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        7⤵
        
        PID:16632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4039.exe
        6⤵
        
        PID:10184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        6⤵
        
        PID:18260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21367.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
        6⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18791.exe
        7⤵
        
        PID:16948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46806.exe
        7⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        6⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
        6⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51016.exe
        6⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
        6⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20523.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32782.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        6⤵
        
        PID:17236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
        5⤵
        
        PID:14576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-669.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8752.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        9⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3335.exe
        9⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        8⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        8⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        8⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48687.exe
        7⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        7⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        7⤵
        
        PID:16208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42927.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22600.exe
        6⤵
        
        PID:11984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29726.exe
        6⤵
        
        PID:16972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
        6⤵
        
        PID:18340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exe
        5⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        7⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60104.exe
        7⤵
        
        PID:15172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1207.exe
        6⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59201.exe
        7⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
        6⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
        6⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7835.exe
        6⤵
        
        PID:18292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27614.exe
        5⤵
        
        PID:792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        7⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        7⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        7⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
        6⤵
        
        PID:14032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        6⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        5⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        5⤵
        
        PID:13156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14800.exe
        5⤵
        
        PID:17148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
        5⤵
        
        PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60641.exe
        5⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        6⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-960.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        7⤵
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38143.exe
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
        6⤵
        
        PID:17876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        6⤵
        
        PID:18304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        6⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45823.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        5⤵
        
        PID:18424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45516.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27512.exe
      4⤵
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        5⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        6⤵
        
        PID:8336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40135.exe
        5⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        5⤵
        
        PID:10556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        5⤵
        
        PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
      4⤵
      PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        5⤵
        
        PID:15472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exe
      4⤵
      PID:15148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
      4⤵
      PID:6568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9712.exe
        6⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56936.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40353.exe
        8⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43591.exe
        8⤵
        
        PID:16536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        8⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
        7⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        7⤵
        
        PID:13864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28337.exe
        8⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
        8⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        8⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
        7⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3995.exe
        7⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51951.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14039.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41844.exe
        5⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        7⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        7⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        7⤵
        
        PID:18016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1246.exe
        6⤵
        
        PID:12972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        6⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
        6⤵
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23329.exe
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
        6⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        5⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58680.exe
        5⤵
        
        PID:18404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11440.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        7⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6308 -s 664
        7⤵
        Program crash
        
        PID:17348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        5⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11232.exe
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        6⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3070.exe
        6⤵
        
        PID:14808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31996.exe
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36328.exe
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31070.exe
        5⤵
        
        PID:15276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31399.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56273.exe
        5⤵
        
        PID:17616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40776.exe
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        5⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        5⤵
        
        PID:13112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14270.exe
        5⤵
        
        PID:17128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5954.exe
        5⤵
        
        PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19838.exe
      4⤵
      PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        5⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        5⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31833.exe
        5⤵
        
        PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
      4⤵
      PID:10684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
      4⤵
      PID:14600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42694.exe
      4⤵
      PID:18252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54453.exe
      4⤵
      PID:5588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62277.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        5⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
        6⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        7⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23319.exe
        7⤵
        
        PID:17164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26222.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        6⤵
        
        PID:13576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exe
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
        6⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        6⤵
        
        PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36229.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        5⤵
        
        PID:14168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10055.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-960.exe
        6⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        6⤵
        
        PID:14520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17198.exe
        5⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45688.exe
        5⤵
        
        PID:15424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27535.exe
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52328.exe
      4⤵
      PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        5⤵
        
        PID:14988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15659.exe
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
      4⤵
      PID:456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40940.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3744.exe
      4⤵
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48270.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
        6⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17105.exe
        7⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40423.exe
        7⤵
        
        PID:16996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10135.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        6⤵
        
        PID:18384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26286.exe
        5⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        5⤵
        
        PID:12228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        5⤵
        
        PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46376.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29809.exe
        5⤵
        
        PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
      4⤵
      PID:9652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50472.exe
      4⤵
      PID:15372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
      4⤵
      PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
      4⤵
      PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17879.exe
    3⤵
    PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
      4⤵
      PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        5⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3920.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20135.exe
        6⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27772.exe
        6⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        5⤵
        
        PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5182.exe
        5⤵
        
        PID:18100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        5⤵
        
        PID:18060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30078.exe
      4⤵
      PID:10824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
      4⤵
      PID:12412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
      4⤵
      PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
    3⤵
    PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
      4⤵
      PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        5⤵
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        5⤵
        
        PID:18088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
      4⤵
      PID:10736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
      4⤵
      PID:14220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
      4⤵
      PID:18224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28450.exe
      4⤵
      PID:5216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
    3⤵
    PID:8468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
    3⤵
    PID:11996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
    3⤵
    PID:16232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61566.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64462.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13725.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60833.exe
        7⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
        9⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1780.exe
        9⤵
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37471.exe
        9⤵
        
        PID:18328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        8⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47119.exe
        8⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10855.exe
        8⤵
        
        PID:18216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
        8⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        7⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4039.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        7⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
        6⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 632
        7⤵
        Program crash
        
        PID:6512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 672
        7⤵
        Program crash
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe
        7⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
        7⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14398.exe
        6⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3767.exe
        6⤵
        
        PID:15384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
        6⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19431.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61710.exe
        6⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        8⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12471.exe
        7⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        7⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        7⤵
        
        PID:16908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16908 -s 444
        8⤵
        Program crash
        
        PID:16544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
        6⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26337.exe
        7⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64664.exe
        7⤵
        
        PID:18336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        6⤵
        
        PID:13368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe
        5⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        6⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        7⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        7⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        7⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60438.exe
        7⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54168.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        6⤵
        
        PID:16460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58703.exe
        6⤵
        
        PID:18044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
        5⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5840.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        6⤵
        
        PID:15788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        5⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
        5⤵
        
        PID:832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26340.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22769.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        8⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        9⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47768.exe
        9⤵
        
        PID:18060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1351.exe
        8⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        8⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53784.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        7⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        6⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33057.exe
        7⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        7⤵
        
        PID:16988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exe
        6⤵
        
        PID:13468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
        5⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2224.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39249.exe
        7⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 652
        7⤵
        Program crash
        
        PID:9284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 664
        7⤵
        Program crash
        
        PID:13304
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 732
        6⤵
        Program crash
        
        PID:6776
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 748
        6⤵
        Program crash
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30853.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44319.exe
        5⤵
        
        PID:13608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        5⤵
        
        PID:18292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        5⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        6⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        7⤵
        
        PID:14836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51359.exe
        6⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
        5⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        6⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10638.exe
        5⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32488.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exe
        5⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        5⤵
        
        PID:16628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38671.exe
        5⤵
        
        PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
      4⤵
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        5⤵
        
        PID:6324
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 608
        6⤵
        Program crash
        
        PID:6432
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 608
        6⤵
        Program crash
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2631.exe
        5⤵
        
        PID:14884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
      4⤵
      PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
        5⤵
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe
        5⤵
        
        PID:15468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64744.exe
      4⤵
      PID:10036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
      4⤵
      PID:14268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        7⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6272 -s 692
        8⤵
        Program crash
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        7⤵
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
        6⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56751.exe
        7⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        6⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        5⤵
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
        6⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
        7⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
        7⤵
        
        PID:18372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4484.exe
        7⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28887.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        6⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        6⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48895.exe
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27800.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
        5⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        5⤵
        
        PID:16956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17140.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18855.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25665.exe
        5⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56936.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        7⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
        7⤵
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        7⤵
        
        PID:17504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        6⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52351.exe
        6⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13111.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61633.exe
        6⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
        7⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
        6⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
        6⤵
        
        PID:14552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        6⤵
        
        PID:412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59903.exe
        5⤵
        
        PID:16248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23761.exe
        5⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        6⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        6⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe
        5⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        6⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63128.exe
        6⤵
        
        PID:18260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        5⤵
        
        PID:16900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
        5⤵
        
        PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe
        5⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
        5⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19022.exe
        5⤵
        
        PID:17656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
      4⤵
      PID:9592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29895.exe
      4⤵
      PID:14068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41729.exe
      4⤵
      PID:18280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40076.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39297.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
        5⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        6⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        7⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56072.exe
        7⤵
        
        PID:13504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6356 -s 476
        7⤵
        Program crash
        
        PID:17976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        6⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        6⤵
        
        PID:18324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21483.exe
        6⤵
        
        PID:18088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        6⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
        6⤵
        
        PID:18084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        5⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        5⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        5⤵
        
        PID:18380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
      4⤵
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26286.exe
        5⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        5⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59903.exe
        5⤵
        
        PID:16264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38959.exe
      4⤵
      PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32673.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        5⤵
        
        PID:17324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
      4⤵
      PID:9688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14635.exe
      4⤵
      PID:14108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10247.exe
      4⤵
      PID:18364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22504.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60641.exe
      4⤵
      PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26286.exe
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        5⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59903.exe
        5⤵
        
        PID:16224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe
      4⤵
      PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3920.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
        5⤵
        
        PID:13992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe
      4⤵
      PID:9996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe
      4⤵
      PID:3268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
    3⤵
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
      4⤵
      PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        5⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        5⤵
        
        PID:15760
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6332 -s 644
        5⤵
        Program crash
        
        PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61880.exe
      4⤵
      PID:9372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exe
      4⤵
      PID:13656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29304.exe
      4⤵
      PID:2824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41927.exe
    3⤵
    PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26705.exe
      4⤵
      PID:13036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3335.exe
      4⤵
      PID:15016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42785.exe
    3⤵
    PID:9772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
    3⤵
    PID:13396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 720
    3⤵
    - Program crash
    PID:5048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47285.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47285.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30062.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5856.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 628
        5⤵
        Program crash
        
        PID:5460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 628
        5⤵
        Program crash
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
      4⤵
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22369.exe
        6⤵
        
        PID:10568
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 640
        6⤵
        Program crash
        
        PID:16708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        5⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15515.exe
        5⤵
        
        PID:13472
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 636
        5⤵
        Program crash
        
        PID:18232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
      4⤵
      PID:7072
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7072 -s 636
        5⤵
        Program crash
        
        PID:12652
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7072 -s 656
        5⤵
        Program crash
        
        PID:15020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
      4⤵
      PID:10068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 736
      4⤵
      Program crash
      PID:14684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 736
      4⤵
      Program crash
      PID:17376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19047.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27777.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 636
        5⤵
        Program crash
        
        PID:6676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 636
        5⤵
        Program crash
        
        PID:8100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
      4⤵
      PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        5⤵
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        5⤵
        
        PID:15488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11052.exe
        5⤵
        
        PID:6028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 748
      4⤵
      Program crash
      PID:10844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21070.exe
    3⤵
    PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
      4⤵
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58801.exe
        5⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3335.exe
        5⤵
        
        PID:16892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 624
        5⤵
        Program crash
        
        PID:2180
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 624
      4⤵
      Program crash
      PID:9404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17735.exe
    3⤵
    PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50353.exe
      4⤵
      PID:12364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
    3⤵
    PID:9868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
    3⤵
    PID:14076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33342.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
      4⤵
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32679.exe
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe
        6⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40264.exe
        6⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
        5⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        5⤵
        
        PID:13132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14270.exe
        5⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        5⤵
        
        PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62504.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65201.exe
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32526.exe
        5⤵
        
        PID:16964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
      4⤵
      PID:9060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
      4⤵
      PID:12748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62319.exe
      4⤵
      PID:16608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
    3⤵
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48270.exe
      4⤵
      PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        5⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7022.exe
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3031.exe
        5⤵
        
        PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
      4⤵
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-960.exe
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        5⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
        5⤵
        
        PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46415.exe
      4⤵
      PID:10704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42424.exe
      4⤵
      PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61276.exe
      4⤵
      PID:15608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
    3⤵
    PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
      4⤵
      PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33767.exe
      4⤵
      PID:13560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
      4⤵
      PID:17980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37582.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
    3⤵
    PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12800.exe
      4⤵
      PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        5⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        5⤵
        
        PID:15508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        5⤵
        
        PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16535.exe
      4⤵
      PID:12124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62975.exe
      4⤵
      PID:16772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
    3⤵
    PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
      4⤵
      PID:16932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
      4⤵
      PID:16112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40168.exe
    3⤵
    PID:10044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21454.exe
    3⤵
    PID:14008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28977.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28977.exe
  2⤵
  PID:2060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46817.exe
    3⤵
    PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4352.exe
      4⤵
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        5⤵
        
        PID:13388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7207.exe
        5⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        5⤵
        
        PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
      4⤵
      PID:10920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54623.exe
      4⤵
      PID:15052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
    3⤵
    PID:8436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
    3⤵
    PID:13104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
    3⤵
    PID:17032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
    3⤵
    PID:8552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51670.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51670.exe
  2⤵
  PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
    3⤵
    PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55233.exe
      4⤵
      PID:10476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      4⤵
      PID:15516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
      4⤵
      PID:17020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
      4⤵
      PID:17656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24983.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12827.exe
    3⤵
    PID:15056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
  2⤵
  PID:8104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
    3⤵
    PID:12472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8436.exe
    3⤵
    PID:7580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
  2⤵
  PID:11008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51152.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51152.exe
  2⤵
  PID:14712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
  2⤵
  PID:17508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3832 -ip 3832
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3228 -ip 3228
1⤵
PID:792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3228 -ip 3228
1⤵
PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3104 -ip 3104
1⤵
PID:5908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1916 -ip 1916
1⤵
PID:6220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3104 -ip 3104
1⤵
PID:7432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1916 -ip 1916
1⤵
PID:7300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6272 -ip 6272
1⤵
PID:8988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6256 -ip 6256
1⤵
PID:9204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3428 -ip 3428
1⤵
PID:8936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4224 -ip 4224
1⤵
PID:9260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3672 -ip 3672
1⤵
PID:5144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3672 -ip 3672
1⤵
PID:10304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6256 -ip 6256
1⤵
PID:10364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3428 -ip 3428
1⤵
PID:10628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6272 -ip 6272
1⤵
PID:11032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6068 -ip 6068
1⤵
PID:11308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6316 -ip 6316
1⤵
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6248 -ip 6248
1⤵
PID:11912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5300 -ip 5300
1⤵
PID:11680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4224 -ip 4224
1⤵
PID:12020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 6316 -ip 6316
1⤵
PID:12004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5300 -ip 5300
1⤵
PID:9648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6248 -ip 6248
1⤵
PID:12324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6324 -ip 6324
1⤵
PID:12980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 7072 -ip 7072
1⤵
PID:13060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 6068 -ip 6068
1⤵
PID:12936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3220 -ip 3220
1⤵
PID:14348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6324 -ip 6324
1⤵
PID:14832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 7072 -ip 7072
1⤵
PID:14840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5240 -ip 5240
1⤵
PID:16148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6308 -ip 6308
1⤵
PID:15664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 6148 -ip 6148
1⤵
PID:16660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6308 -ip 6308
1⤵
PID:17036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6148 -ip 6148
1⤵
PID:17172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3220 -ip 3220
1⤵
PID:17292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 7220 -ip 7220
1⤵
PID:16516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 7220 -ip 7220
1⤵
PID:17504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5240 -ip 5240
1⤵
PID:18164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6356 -ip 6356
1⤵
PID:17512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 6332 -ip 6332
1⤵
PID:2972

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe

Filesize
184KB

MD5
77ac73839447b21679138534925ead95

SHA1
5fc39bf89c4791ecf8af60628f2cbd867fd06311

SHA256
dc742bd158f9ffee1c9e307a7d31fbc7a50ce1f48f9f70098afb987c70e2506e

SHA512
cc9feb74519640b55ad81a854cfd523cc47a1cb4311c00f1fc75fbd17ad6340fba6f569fd7e5badead763f9883719b2cfdeca2e437234ed1e05f11740b6f8998

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe

Filesize
184KB

MD5
49ee3cc24279d1deda41820bd72a6e2a

SHA1
5a8869bd547ea29a4489dbad72b4b248408064ec

SHA256
6474050d5e7c4f8dd1b73e207f0253dff8559b6badc68c8753a7e84601d6f395

SHA512
1f15b6139f36aa361405912ecd146cdfddfaa5d7ca3e4bca1e1fa69cd44eb3878bcf5ada1f2b5bea6fdf92e454409aeabbfb37b76d357803f34c6cff44579263

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe

Filesize
184KB

MD5
8e7d2b6935ec7b7f77ea9fc5d6713997

SHA1
8b3ca003b2d4da4e779ca3e888d51a124c41e992

SHA256
6344c58786a51ce7a75ca50e517f9fdd8ed31d203c1947728f267ec75e0f3ac4

SHA512
f7ce2ca42fa0eff609d60c2df3cb1074f265c40e473a9f7eaca3453418321736da12f4b3e4766a30e84b72e20c7f5c7ffb82b5b6db1132cd613e597cba07cbd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13725.exe

Filesize
184KB

MD5
640680d9f55bcee38e48b899f425ca98

SHA1
abf4fab165fd0fbbc08a821a5be003558e775357

SHA256
f273fb2db50957fbb9bf09c3ff4c6ff73a867e665647167c55a7b64b03391c13

SHA512
8827ae9ccd9dee17f2300be26a6a035dd0891493e0547192eb6430073ade3d830ff74ae86b1e99c33b5f07fd9d3cd393617a8bbb7c705a8ca67d5bc16b9b4383

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe

Filesize
184KB

MD5
0d89a95a9e1b3ca8a72a5e2bc6d2219b

SHA1
d329b6beb1ad40e353e2b1a2113e5236234bcc7e

SHA256
0ddc63dfa87e3c4c41eb8ca4466c385540a9d852e17c4d3cd5049553ce4f8bc9

SHA512
be71749f57058c8cb6db74020b7014c4ba29337c258e5f5e2b9d403bf2e31b844e5eccb68e53633601dfa0a03fdca1626aa914b11cc248d06ca859888af5196c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe

Filesize
184KB

MD5
0b1eb1770909bbf2ce658c481109aeb4

SHA1
f7c9d54c729a888dc9977a10d87a59e4af1f0b4e

SHA256
08135f8d6d4fb6483f7a055b5169d3b4e3d54dd760905d9f38d8d334c3fad554

SHA512
1cbca209383b971ce6c08dcc4247da4e896bb33db5b2ebdf030302888f9723ebaebe7847aa76f381c702b5d8bcad7201a650d8facc92902c7187cabe4cc30c55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16238.exe

Filesize
184KB

MD5
465d9a60368a9435458a31e3665087f1

SHA1
a0b8230c890bee763485cfd165aa859137d80f7a

SHA256
50d950f6178834260be94d4bc04cf994960f382af0ea022debcdb9bf2a2ce2d0

SHA512
f01001f38a55e71d377b9dd0f2c3aaa7803c3a2910a47d9b7d25c7466cbc2d7ba242d04744a2d3778f8d047dac178c7431b4b0f3b4fb873eeb8754ddc389efd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe

Filesize
184KB

MD5
b7930b0c6e5aa9ae204b69f0c10ef08c

SHA1
29d560ce7b75487fd8b065590eb7490151aec002

SHA256
5b24f9b7966219842c34d76bbfb41d48862b935663e5399b940624d82b813cc5

SHA512
a96b9eb604d84822702f8b7824ba718bc90757515c4d568e3b896a970ad4cd6b61c6643ddd308a7cb23800a63e3cb56a113a0750471a109f8fce56d077d577cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26340.exe

Filesize
184KB

MD5
92e135823b2aa849f01d2dd666445e89

SHA1
b787d0c84ee02a6a305a8753e423fe2200415dd1

SHA256
0d2f6eaf7b5008cba37a23fb2f2e1992ce68f25ad48e50af1ca6daeea30cdfba

SHA512
273f666cf20e235860484378292a134b3e36898cef12bc6a7ae591c76a17d90e28769bd654f14f02450c35b5ed97e1baaa343048c1440deb3efd928da19daaec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe

Filesize
184KB

MD5
37928ed2f316bf436b1cc6c8070e48c0

SHA1
8a5eeb9d8d226632e8154cbbc0bbd1969c782f12

SHA256
a947b7d770dc621567422c3f9ec5478202e49423240a0407b6c8c68b4f6c5e7b

SHA512
7ca8d0657037e005f6a9cfb703fba94a5b9e81e4a33b1237b38ee1add3759176016bfa4ceab8252d4270eca5510a01888c2689749bb5161b1e9b1f26f2874f8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe

Filesize
184KB

MD5
cd887de13536e77f42356887cc6c718e

SHA1
c809d33c124cf863fb897ffdfc67711b5b863d35

SHA256
729ff8c668effd9393d0137773cf8fabbb588abf8449ec38d6f19c21c6780bb1

SHA512
43e4fc94e5d704914550d3e811b23146172ed31f0307d9abde564fc1ac625ab8c911e711fd21a0b48718a822260482a71c854a47da5003c66122b1dce7e1ca82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe

Filesize
184KB

MD5
8b1e175291f94c49525a073ec38e7790

SHA1
fdfd978d398567ece99b88d63be0cd18baa5a532

SHA256
da129d0c125af2100b1aa20c26c9728437aef3773fbdbfdc1f93b4ba7a15a0ac

SHA512
3da5ea056773af9294e5303fbae12c142a48b33e40742885615afa77658df1c7695483c0776cec5482168ed3f7299674277670053508b8e1b99f91132c2d5742

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe

Filesize
184KB

MD5
cfe667088e301088551264fc7ca29f34

SHA1
e008723530ceff6858dd38bba7398c14e9b3a385

SHA256
1c63f319263b7b0360a591a1815a39238c3fd60008ce12ca6b959c18547e4293

SHA512
12ae81d8d082ab3905cc15fda411cee22f22f574ac1c85d8851deae2b447689e539d8552f24cd05984881081b4e8361f06222895c6406ad755b14ec4b9c7d535

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe

Filesize
184KB

MD5
7f5e5003d8b066bf9d4e4963615b2c51

SHA1
ce83b448ad2c0b9133ac7d20d35d547a2e2d7bfe

SHA256
bff012d72b0fffe85377af97695b0b42f218cb146bfb25d655ed49c6ba100a98

SHA512
b2e1b2561d909d64aab53cba573db537c43e89e5f60148bf19081815615019de78b4aa6ded80053e52e7765a7d180156ccbe6c77945d734cd235f83b4dd0b603

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30062.exe

Filesize
184KB

MD5
8494c3edcde8450b2246debc4a79890b

SHA1
146b4fa73d3925914af9e7f7bd381ff5077f7ab9

SHA256
88cfd3cb8fda7457814c9b063b02f9b93319960aafe35dfd0a9ab2e6488954ea

SHA512
60013de67056cbe814c82565065c914ba49c0f24929eefc7283e03a63fb06000bd1538c9970bcda9e632a777080e5bdb8ab53622a3e8a7fe1db32fb846c87749

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe

Filesize
184KB

MD5
c9fe62161107a5685a2c021ce7600235

SHA1
187c401f960b3ce9ee1c53c11072ca7f3526aded

SHA256
ed19dd8c22e3d2dc931a5c1a0786ba3994526d4287e1cac85ddb8ef28b80a384

SHA512
e95ea72b8aff503e6f31e7fb44542ac165c0510c9d536fb178af9deffa49547cece821b4b5067f0c9b6eab9cb7cb08a790c452e7561cb52b163482e7620786a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe

Filesize
184KB

MD5
a7248e0629a8f13a35a55dab54a9a5fa

SHA1
b1b156f8f748365d65f42d41880dbcc8b9af4291

SHA256
c4bcd481b34110953ed36cbe63663c03521daf23dae2b7485b61332e3e14a932

SHA512
5d16e2464d86b58eb1f5868c4562123e725995ce6c11ae2886dbdc0047df80c290df97dc5e9a3710fcc9f6f3afdb8add4d5e36a87704367b5a4b58bd8b2baf3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4004.exe

Filesize
184KB

MD5
7887c1cbf6e63f2dd9c8a8c28b37c59c

SHA1
c057c387e97d9e3cb0b9f2f3dccf7b5e9af6b91a

SHA256
78f12f6baf4c977c5ee13262c7b0b3b2675e45b483745184a4ac78a4534afc9c

SHA512
fe965128707c99f220df2ecddf54314f82ec36a6d048e69d0d7f9477cd2b4ab0033e6f7bd9389c5d6ee4308d1e0e365fcd53c2dcc7ef905ccf837daca1eabf66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40076.exe

Filesize
184KB

MD5
984755bbb3882db1c60d0458716aa39c

SHA1
f6647ab04d9e8831f5b5807d5f49aaf5b2b07f92

SHA256
ff8c7785bd4df21c4afe30ac13af36f467e306dfd14093cca7c925f4c6298015

SHA512
a4a63b8044a6a1695b32854405e8862bc80a89b4f45b4b15562e9c30d431aebd5e507610e04535f6854954d430e70b35384cddf76b99b0c582cc5c59c06805df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe

Filesize
184KB

MD5
86b05d14076a5680b2b26599a53000f7

SHA1
9c0b4d377632bf266b5cb0dc68eed7116049596c

SHA256
db35c436f2a804e089b90f3b68733ca357c947e3dc6bdf4adc1ea3f2d38a4ca9

SHA512
d59ea5e3d2944d949a82c02a63c9533296f9196df478a13d6b55e7b6f77cd21c111585b8f63d5e8717655f43e946cbd97e951db0b932aa3594e791314ccd4a57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44997.exe

Filesize
184KB

MD5
02c7dbe23beabf727cf71f732604bbcb

SHA1
de3a32d2a98a416e03ec4c2e6c0f62a3af7c41e3

SHA256
d874c5367f154763a76c772a075f627270e333c6f5155eac2822c3e4ec46668c

SHA512
b11d6453b701e574358da56231ec2452e942050fa50889257e865f435dbcce718944c26bb6326383987c404beec3b342cdc3b4b763cbb4abed17449fc683aa7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe

Filesize
184KB

MD5
811cf421f7cc3f6f7f3dd3c39cfbd267

SHA1
fcf52417d46cd8b44b7b79460e9b62c8562ee279

SHA256
b38de293c5b42b82eb1dcb90930fbf8b6ac235d6da52f6dbf846de2c7bd8fc7e

SHA512
18d6ae1968f7a3d65f615ad86f47a5567db07d89adf228a69f7564d419396cf0f4bef04a9853cdcc8339f505ea10677fcf6b173eb50c0d81eeb13582c948efe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47285.exe

Filesize
184KB

MD5
d5e365b03cd278c22a928878763fff92

SHA1
e2c2d2c0882b0e240b7a89302b4f1843577a0685

SHA256
11d9812463d0a8fdd4dd0ad1dacecfea6c39344fe43c8dee711970c8e395212e

SHA512
41ca66e59d85fd0861d22efb85736e77f1a17b5efaf2de6571b0476d7814f4efbc6353652e231f9f3f0c08bd8139c54233a768a4573ba426eb5acaa11e878b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe

Filesize
184KB

MD5
808502b9da79181e62ad7199458735ae

SHA1
bd918a54a59514b7fa5a834634500a0bff29bcfd

SHA256
31b49f50eb3df8b5f196a65cf74ef265e5c54cd641cfd8c4e921e4a347f835f7

SHA512
4c95bb9bbc6c454fa26d4848a03ecf30d96a341737ea00d80b4007736e98b41b53181019e533e107425786ef6b0ab216f833ec6ee9348d698b48b7ceed8c5f69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe

Filesize
184KB

MD5
672482fef1dad83413d2f0d8ea05bc11

SHA1
64b83cae49ee0ace8661f144f03d59bf9d8c6477

SHA256
095e24fd961e708b6060fe82ba0262c115b448ebbffb65e22d610017a3b38db5

SHA512
3b401afe6121d072d370399e0a7f4e40abebab5bc30c44e353f3e44aee043438820aa9476aaf4e6c3f184f4b9b4dfc9d027df9d00d5c1d20cf6b390313d78836

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe

Filesize
184KB

MD5
0c2cfe6ac8063d00d51a3c6d7b87849d

SHA1
622572adfe73073d2b3a3f6b9aa4b4b39a1814e4

SHA256
f442beec860fd21605a910e12ed797be73e722197abf721b72e8fcba3bf7fa23

SHA512
b3af85ef45d8f3fc9d201127893a3201f5c5d74162c149058ae3095d5ead1007b5569eae2a6484747618d8fc8335ab126907b5d63e3362734aa6a9392ebf02a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61566.exe

Filesize
184KB

MD5
7d32858f16fcd395945648543a49de6b

SHA1
80b64f2eeb8a20f4fe981df489e8a1738cd635f6

SHA256
5e9c80debcd788cb4a478966d06b0105f79a72cc39f0d781f460f705ca62299d

SHA512
b5a14d4c7c06adfa6313d6af18dd1dae43084fe6c161f475c6fcd1c21f0edb189d883f29b891ce70c9d9435fd891aeca690f6e0d9bad4c911d6309d3bcc42bed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62277.exe

Filesize
184KB

MD5
f04b1156c878868675bfc1ce482a81cf

SHA1
aa7c38edf30cad35254bd39cbee57647261bfe35

SHA256
46bbc1d17e2de633e2348d24c5549e301aed947cd0aeb51a52ce98c0378ee4f2

SHA512
144c068ffb3817170631d47c0da4be64a1aad28e8623a684143f3d5a4af81119ce8b3a48b49cbfec9b4adaabf10c7d52273cb8fb1d2098d44f950f8ae6d168ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exe

Filesize
184KB

MD5
573b65f0ec9486405ec828b1eb03369a

SHA1
aae7016d4bb5c5dcddb037061944d750f30039a6

SHA256
90f0ee83e8059c6542706f5bf53304b3b6d703778df6ff17eb3d67796e8481eb

SHA512
a1a4471759278efd984a2903d71fd3f444fe58c0f76b49e3863de49f1b6d18a3136185b446eb7af05f9ddba14293448fc02dad43414c663cb3ffff9752c0e9de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe

Filesize
184KB

MD5
9eb27c9500934dc93ace74a3c3e00bb4

SHA1
f0fd37a3707144742f9f76ebd5e767370a0c97bd

SHA256
d95c8535c8d9c3ea793a80266e698bd197315caaff8f8e677e054caf5a46ce89

SHA512
9ec64bbdfa7631969385c88b172c2929e505ca929e48ab217cf8451a2287d8244e33df3f817bbb76d30c5ad6154528f0b6eb1fa5735efd1a3a5fe682a2d5c9a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64462.exe

Filesize
184KB

MD5
df70dfa56c63e16038d711d9928ea9f5

SHA1
8b35c9c9b9e2e00847228cd88fad0c8182572da9

SHA256
c497e8a66324f4c6f393b6654e5fed04472574e493d1ce386132afde3f7772be

SHA512
710e3b6407bc1f10224d645fa4b8fbadb82ad886eb5776cd86d6b731bca291645cca0c22d448bb626fb8f1b7fc2daa1b7f6b01509fe587ffeb6edef43b2ef27f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8644.exe

Filesize
184KB

MD5
24256a210c397f9262347c4986d57745

SHA1
594b67e7a9c3faceda4904e4e263c36285531c90

SHA256
3fc63031184f3499784047a46c1be6e277c7ddf2ebd21b0dbc7c90a026572985

SHA512
98d39eb729ebaccca45b6d3cc06c7a74301894796264efe56545aa78d3e92711dffdda1c68fa062483befc1f787f4d96d1403e0e14e91e5b5b0c27a29234b597

Download Submit
memory/3152-3239-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads