5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088c

Analysis

max time kernel
120s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe
Size

468KB
MD5

6c7ae734007e0eb14def14d9a365c920
SHA1

0ef300e320a7b1b3b713f23887255435bbba761c
SHA256

5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088c
SHA512

36a018bccb81b63ece71ed3bc18ef01566d73b696bf2ee12a7414c88e82b4cda1af2fdcac7dae98000a9cbbc598b78df8b4d1034ad24f6adbf42bba802830db1
SSDEEP

3072:1O0bogCdj08G2bY9Pze1ff8l5CyAWipCnmHevVpEl8NNWC//kkla:1O8oh5G2+Pq1ffgqoMl83d//k

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4916	Unicorn-56765.exe
2620	Unicorn-5940.exe
1492	Unicorn-43443.exe
3720	Unicorn-54321.exe
464	Unicorn-18119.exe
1236	Unicorn-31854.exe
2944	Unicorn-20387.exe
3708	Unicorn-52889.exe
2008	Unicorn-28171.exe
2124	Unicorn-33738.exe
1676	Unicorn-39604.exe
4460	Unicorn-1716.exe
2712	Unicorn-48871.exe
860	Unicorn-35327.exe
4268	Unicorn-43325.exe
3192	Unicorn-15291.exe
4104	Unicorn-26989.exe
2028	Unicorn-12690.exe
4840	Unicorn-14736.exe
4320	Unicorn-6568.exe
4904	Unicorn-59091.exe
1188	Unicorn-2219.exe
3064	Unicorn-4212.exe
2152	Unicorn-61581.exe
4312	Unicorn-51367.exe
4660	Unicorn-32779.exe
632	Unicorn-44212.exe
4044	Unicorn-15889.exe
5028	Unicorn-1590.exe
3768	Unicorn-49905.exe
3260	Unicorn-33569.exe
3268	Unicorn-58820.exe
516	Unicorn-47283.exe
1192	Unicorn-57881.exe
1772	Unicorn-57881.exe
2352	Unicorn-5424.exe
1960	Unicorn-38843.exe
4500	Unicorn-26591.exe
2528	Unicorn-37526.exe
5088	Unicorn-46457.exe
1072	Unicorn-46457.exe
4056	Unicorn-46457.exe
1900	Unicorn-4655.exe
1484	Unicorn-10255.exe
1968	Unicorn-29856.exe
3640	Unicorn-63177.exe
3312	Unicorn-10639.exe
1872	Unicorn-52077.exe
1848	Unicorn-27308.exe
1832	Unicorn-27573.exe
1000	Unicorn-7152.exe
3548	Unicorn-1022.exe
1144	Unicorn-35170.exe
3748	Unicorn-44101.exe
2816	Unicorn-40017.exe
4284	Unicorn-52248.exe
1132	Unicorn-6311.exe
556	Unicorn-47609.exe
3252	Unicorn-27189.exe
3048	Unicorn-64692.exe
408	Unicorn-4722.exe
1856	Unicorn-10852.exe
1480	Unicorn-10852.exe
3460	Unicorn-19767.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
7040	3152	WerFault.exe
6912	2460	WerFault.exe
2520	2344	WerFault.exe
7424	3008	WerFault.exe
13972	6252	WerFault.exe	287
16292	15048	WerFault.exe	716

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55876.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4228	dwm.exe
Token: SeChangeNotifyPrivilege	4228	dwm.exe
Token: 33	4228	dwm.exe
Token: SeIncBasePriorityPrivilege	4228	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe
4916	Unicorn-56765.exe
1492	Unicorn-43443.exe
2620	Unicorn-5940.exe
3720	Unicorn-54321.exe
464	Unicorn-18119.exe
1236	Unicorn-31854.exe
2944	Unicorn-20387.exe
2124	Unicorn-33738.exe
2008	Unicorn-28171.exe
3708	Unicorn-52889.exe
1676	Unicorn-39604.exe
4460	Unicorn-1716.exe
2712	Unicorn-48871.exe
860	Unicorn-35327.exe
4268	Unicorn-43325.exe
3192	Unicorn-15291.exe
4104	Unicorn-26989.exe
4904	Unicorn-59091.exe
1188	Unicorn-2219.exe
4840	Unicorn-14736.exe
4320	Unicorn-6568.exe
2028	Unicorn-12690.exe
3064	Unicorn-4212.exe
4660	Unicorn-32779.exe
4312	Unicorn-51367.exe
2152	Unicorn-61581.exe
632	Unicorn-44212.exe
4044	Unicorn-15889.exe
5028	Unicorn-1590.exe
3768	Unicorn-49905.exe
3260	Unicorn-33569.exe
3268	Unicorn-58820.exe
516	Unicorn-47283.exe
1192	Unicorn-57881.exe
1772	Unicorn-57881.exe
2352	Unicorn-5424.exe
1960	Unicorn-38843.exe
4500	Unicorn-26591.exe
4056	Unicorn-46457.exe
1072	Unicorn-46457.exe
1968	Unicorn-29856.exe
1900	Unicorn-4655.exe
2528	Unicorn-37526.exe
5088	Unicorn-46457.exe
1484	Unicorn-10255.exe
3640	Unicorn-63177.exe
3312	Unicorn-10639.exe
1872	Unicorn-52077.exe
1848	Unicorn-27308.exe
1832	Unicorn-27573.exe
1000	Unicorn-7152.exe
3548	Unicorn-1022.exe
1144	Unicorn-35170.exe
3748	Unicorn-44101.exe
2816	Unicorn-40017.exe
1132	Unicorn-6311.exe
4284	Unicorn-52248.exe
3252	Unicorn-27189.exe
556	Unicorn-47609.exe
4432	Unicorn-19767.exe
408	Unicorn-4722.exe
3712	Unicorn-14863.exe
1480	Unicorn-10852.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 4916	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	89
PID 2164 wrote to memory of 4916	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	89
PID 2164 wrote to memory of 4916	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	89
PID 4916 wrote to memory of 2620	4916	Unicorn-56765.exe	92
PID 4916 wrote to memory of 2620	4916	Unicorn-56765.exe	92
PID 4916 wrote to memory of 2620	4916	Unicorn-56765.exe	92
PID 2164 wrote to memory of 1492	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	93
PID 2164 wrote to memory of 1492	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	93
PID 2164 wrote to memory of 1492	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	93
PID 2620 wrote to memory of 3720	2620	Unicorn-5940.exe	95
PID 2620 wrote to memory of 3720	2620	Unicorn-5940.exe	95
PID 2620 wrote to memory of 3720	2620	Unicorn-5940.exe	95
PID 4916 wrote to memory of 464	4916	Unicorn-56765.exe	97
PID 4916 wrote to memory of 464	4916	Unicorn-56765.exe	97
PID 4916 wrote to memory of 464	4916	Unicorn-56765.exe	97
PID 2164 wrote to memory of 1236	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	98
PID 2164 wrote to memory of 1236	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	98
PID 2164 wrote to memory of 1236	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	98
PID 1492 wrote to memory of 2944	1492	Unicorn-43443.exe	99
PID 1492 wrote to memory of 2944	1492	Unicorn-43443.exe	99
PID 1492 wrote to memory of 2944	1492	Unicorn-43443.exe	99
PID 1236 wrote to memory of 3708	1236	Unicorn-31854.exe	101
PID 1236 wrote to memory of 3708	1236	Unicorn-31854.exe	101
PID 1236 wrote to memory of 3708	1236	Unicorn-31854.exe	101
PID 2620 wrote to memory of 2008	2620	Unicorn-5940.exe	102
PID 2620 wrote to memory of 2008	2620	Unicorn-5940.exe	102
PID 2620 wrote to memory of 2008	2620	Unicorn-5940.exe	102
PID 2164 wrote to memory of 1676	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	103
PID 2164 wrote to memory of 1676	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	103
PID 2164 wrote to memory of 1676	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	103
PID 4916 wrote to memory of 2124	4916	Unicorn-56765.exe	104
PID 4916 wrote to memory of 2124	4916	Unicorn-56765.exe	104
PID 4916 wrote to memory of 2124	4916	Unicorn-56765.exe	104
PID 2944 wrote to memory of 4460	2944	Unicorn-20387.exe	105
PID 2944 wrote to memory of 4460	2944	Unicorn-20387.exe	105
PID 2944 wrote to memory of 4460	2944	Unicorn-20387.exe	105
PID 1492 wrote to memory of 2712	1492	Unicorn-43443.exe	106
PID 1492 wrote to memory of 2712	1492	Unicorn-43443.exe	106
PID 1492 wrote to memory of 2712	1492	Unicorn-43443.exe	106
PID 464 wrote to memory of 860	464	Unicorn-18119.exe	107
PID 464 wrote to memory of 860	464	Unicorn-18119.exe	107
PID 464 wrote to memory of 860	464	Unicorn-18119.exe	107
PID 3708 wrote to memory of 4268	3708	Unicorn-52889.exe	108
PID 3708 wrote to memory of 4268	3708	Unicorn-52889.exe	108
PID 3708 wrote to memory of 4268	3708	Unicorn-52889.exe	108
PID 1236 wrote to memory of 3192	1236	Unicorn-31854.exe	109
PID 1236 wrote to memory of 3192	1236	Unicorn-31854.exe	109
PID 1236 wrote to memory of 3192	1236	Unicorn-31854.exe	109
PID 2008 wrote to memory of 4104	2008	Unicorn-28171.exe	110
PID 2008 wrote to memory of 4104	2008	Unicorn-28171.exe	110
PID 2008 wrote to memory of 4104	2008	Unicorn-28171.exe	110
PID 2620 wrote to memory of 2028	2620	Unicorn-5940.exe	111
PID 2620 wrote to memory of 2028	2620	Unicorn-5940.exe	111
PID 2620 wrote to memory of 2028	2620	Unicorn-5940.exe	111
PID 2124 wrote to memory of 4840	2124	Unicorn-33738.exe	112
PID 2124 wrote to memory of 4840	2124	Unicorn-33738.exe	112
PID 2124 wrote to memory of 4840	2124	Unicorn-33738.exe	112
PID 1676 wrote to memory of 4320	1676	Unicorn-39604.exe	113
PID 1676 wrote to memory of 4320	1676	Unicorn-39604.exe	113
PID 1676 wrote to memory of 4320	1676	Unicorn-39604.exe	113
PID 2164 wrote to memory of 4904	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	114
PID 2164 wrote to memory of 4904	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	114
PID 2164 wrote to memory of 4904	2164	5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe	114
PID 4916 wrote to memory of 1188	4916	Unicorn-56765.exe	115

C:\Users\Admin\AppData\Local\Temp\5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe
"C:\Users\Admin\AppData\Local\Temp\5a4220688f1c350aa33fc3845eb14cdb7381b86742921afb6162a25e1b34088cN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5940.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54321.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51367.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52337.exe
        9⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        9⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
        9⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        8⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65003.exe
        8⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
        8⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59486.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64951.exe
        7⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        7⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37241.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12347.exe
        7⤵
        
        PID:12084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34618.exe
        6⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
        6⤵
        
        PID:10276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17190.exe
        6⤵
        
        PID:15056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27308.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34153.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12824.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
        8⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        8⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64669.exe
        8⤵
        
        PID:16176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65092.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29957.exe
        7⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48512.exe
        6⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        7⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44598.exe
        7⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12626.exe
        6⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        6⤵
        
        PID:14508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
        6⤵
        
        PID:16324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32814.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
        7⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43187.exe
        7⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        7⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31982.exe
        6⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5331.exe
        6⤵
        
        PID:14208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46454.exe
        6⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
        5⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        6⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
        5⤵
        
        PID:14048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4973.exe
        5⤵
        
        PID:16472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28171.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26989.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5424.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        7⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        9⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        9⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        9⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        8⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exe
        8⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31116.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18475.exe
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        8⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe
        8⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        8⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        7⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29924.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        7⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16451.exe
        6⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52757.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        8⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53188.exe
        7⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        7⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57099.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        7⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        6⤵
        
        PID:13444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        6⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38843.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29109.exe
        6⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 604
        7⤵
        Program crash
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51901.exe
        7⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        7⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63679.exe
        7⤵
        
        PID:16776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
        6⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        5⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52897.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        7⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        7⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18247.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15802.exe
        6⤵
        
        PID:14220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42648.exe
        5⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1740.exe
        6⤵
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
        6⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        6⤵
        
        PID:15748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62815.exe
        5⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10360.exe
        6⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        5⤵
        
        PID:14304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        5⤵
        
        PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46457.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        6⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        8⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        8⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53274.exe
        8⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20358.exe
        7⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        7⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2034.exe
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21289.exe
        7⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        7⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        7⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2871.exe
        6⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21258.exe
        6⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        6⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41413.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8476.exe
        8⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50116.exe
        7⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        7⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
        6⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        5⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        5⤵
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29109.exe
        5⤵
        
        PID:2460
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 620
        6⤵
        Program crash
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
        5⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21289.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        7⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        7⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        6⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        6⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62543.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        5⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        5⤵
        
        PID:15860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
      4⤵
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
        6⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
        6⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        5⤵
        
        PID:15720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38915.exe
      4⤵
      PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        5⤵
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        5⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13549.exe
        5⤵
        
        PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
      4⤵
      PID:12400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
      4⤵
      PID:15636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35327.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15889.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36997.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe
        8⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        8⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exe
        7⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47453.exe
        7⤵
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15351.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        8⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        7⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        7⤵
        
        PID:15120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14878.exe
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3795.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        6⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64692.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64085.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33733.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        7⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
        6⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57661.exe
        6⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        6⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exe
        6⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63784.exe
        5⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        6⤵
        
        PID:11984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3653.exe
        6⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42063.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        5⤵
        
        PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1590.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44101.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46981.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
        8⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        8⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        7⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        7⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27338.exe
        7⤵
        
        PID:16500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        6⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57485.exe
        7⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        7⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31702.exe
        6⤵
        
        PID:11112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        6⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40135.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29161.exe
        6⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6252 -s 632
        7⤵
        Program crash
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15699.exe
        6⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28632.exe
        6⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        6⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        5⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44465.exe
        6⤵
        
        PID:14312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        6⤵
        
        PID:14600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10131.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44087.exe
        5⤵
        
        PID:14492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23844.exe
        5⤵
        
        PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30837.exe
        5⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57661.exe
        6⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        7⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        7⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13883.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        6⤵
        
        PID:13604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        6⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
        5⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4444.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        6⤵
        
        PID:16424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33238.exe
        5⤵
        
        PID:10608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        5⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        5⤵
        
        PID:15732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        6⤵
        
        PID:13340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        6⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe
        5⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
        5⤵
        
        PID:14636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50577.exe
        5⤵
        
        PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1879.exe
      4⤵
      PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        5⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11659.exe
        5⤵
        
        PID:14148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29433.exe
      4⤵
      PID:10364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
      4⤵
      PID:15048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15048 -s 464
        5⤵
        Program crash
        
        PID:16292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35533.exe
      4⤵
      PID:16180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44869.exe
        6⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18969.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1828.exe
        8⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        8⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        8⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54900.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63747.exe
        7⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        7⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        6⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16629.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        7⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
        7⤵
        
        PID:15184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56959.exe
        6⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62020.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        5⤵
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe
        6⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1828.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13549.exe
        7⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1858.exe
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47604.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49897.exe
        6⤵
        
        PID:15460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49369.exe
        7⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        6⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55974.exe
        6⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62824.exe
        5⤵
        
        PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
        5⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        5⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9752.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64973.exe
        7⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        7⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44967.exe
        6⤵
        
        PID:13924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18292.exe
        6⤵
        
        PID:16464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51268.exe
        6⤵
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        6⤵
        
        PID:16432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
        5⤵
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
        5⤵
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
      4⤵
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
        5⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
        6⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3167.exe
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9081.exe
        6⤵
        
        PID:668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14635.exe
        5⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        5⤵
        
        PID:12024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        5⤵
        
        PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
      4⤵
      PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
        5⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20397.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24265.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
        5⤵
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48693.exe
        5⤵
        
        PID:15716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
      4⤵
      PID:8580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
      4⤵
      PID:12184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40209.exe
        5⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23785.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58237.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
        7⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        7⤵
        
        PID:15980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56888.exe
        6⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        6⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18475.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
        6⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        7⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        7⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        6⤵
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        5⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25683.exe
        6⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24216.exe
        5⤵
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18672.exe
        5⤵
        
        PID:9712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45040.exe
      4⤵
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33733.exe
        6⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49382.exe
        6⤵
        
        PID:15800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
        5⤵
        
        PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exe
        5⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        5⤵
        
        PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
      4⤵
      PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65165.exe
        5⤵
        
        PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        5⤵
        
        PID:12504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        5⤵
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16467.exe
      4⤵
      PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22410.exe
      4⤵
      PID:12684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
      4⤵
      PID:15472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49389.exe
        5⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63679.exe
        6⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65092.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
        5⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50539.exe
        5⤵
        
        PID:16196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
      4⤵
      PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
        5⤵
        
        PID:13940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        5⤵
        
        PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exe
      4⤵
      PID:11044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
      4⤵
      PID:14132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
      4⤵
      PID:976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exe
    3⤵
    PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
      4⤵
      PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7708.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
        6⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36327.exe
        5⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
        5⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
      4⤵
      PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        5⤵
        
        PID:11584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56554.exe
        5⤵
        
        PID:17144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44863.exe
      4⤵
      PID:12100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
      4⤵
      PID:2272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62997.exe
    3⤵
    PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
      4⤵
      PID:12312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50005.exe
      4⤵
      PID:5904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2946.exe
    3⤵
    PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21822.exe
      4⤵
      PID:17276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52483.exe
    3⤵
    PID:12628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3257.exe
    3⤵
    PID:15504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20387.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4212.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45061.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45549.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        9⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47272.exe
        9⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe
        9⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        8⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        8⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        8⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33031.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
        8⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50239.exe
        7⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19966.exe
        7⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50378.exe
        7⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
        6⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52897.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        8⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        8⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        8⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2871.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28632.exe
        7⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18442.exe
        7⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36783.exe
        6⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        7⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        6⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4220.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        8⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        8⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        8⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
        7⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        7⤵
        
        PID:15880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63784.exe
        6⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5734.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        7⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
        7⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40972.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58399.exe
        6⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        6⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51375.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        7⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        7⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe
        6⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24058.exe
        6⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        6⤵
        
        PID:17396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1424.exe
        7⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        7⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        6⤵
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49382.exe
        6⤵
        
        PID:15844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63827.exe
        5⤵
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        5⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10116.exe
        5⤵
        
        PID:16400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32779.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46981.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7220.exe
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30602.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        7⤵
        
        PID:16800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
        7⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        6⤵
        
        PID:15100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46454.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31007.exe
        5⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29649.exe
        6⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        6⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        5⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42265.exe
        6⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        6⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39104.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17190.exe
        5⤵
        
        PID:15108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        5⤵
        
        PID:15924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1022.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54765.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3608.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52929.exe
        7⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55402.exe
        7⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2870.exe
        6⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        5⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
        5⤵
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        5⤵
        
        PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
      4⤵
      PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        5⤵
        
        PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-874.exe
      4⤵
      PID:8196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28651.exe
      4⤵
      PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45336.exe
      4⤵
      PID:6456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40017.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46981.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52897.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
        8⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
        8⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29832.exe
        8⤵
        
        PID:17124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23047.exe
        6⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9488.exe
        7⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50823.exe
        6⤵
        
        PID:14716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28997.exe
        6⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4952.exe
        6⤵
        
        PID:808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        6⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23134.exe
        5⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35721.exe
        6⤵
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        6⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33526.exe
        5⤵
        
        PID:15028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2137.exe
        5⤵
        
        PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41413.exe
        6⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exe
        7⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        7⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49819.exe
        6⤵
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64359.exe
        5⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8159.exe
        5⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
        5⤵
        
        PID:11132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44729.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
        6⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        6⤵
        
        PID:13608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2871.exe
        5⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
        5⤵
        
        PID:14292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38564.exe
      4⤵
      PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18891.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
      4⤵
      PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
      4⤵
      PID:12884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30879.exe
      4⤵
      PID:6704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38429.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        6⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        5⤵
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
        5⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        5⤵
        
        PID:15068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        5⤵
        
        PID:16448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
      4⤵
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
        5⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        5⤵
        
        PID:15328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56118.exe
        5⤵
        
        PID:16456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65127.exe
      4⤵
      PID:8220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4843.exe
      4⤵
      PID:12040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe
      4⤵
      PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26753.exe
      4⤵
      PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57749.exe
        5⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13172.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
        6⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        6⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
        5⤵
        
        PID:14840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
      4⤵
      PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12560.exe
        5⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32433.exe
        5⤵
        
        PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31702.exe
      4⤵
      PID:11120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
      4⤵
      PID:13384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
      4⤵
      PID:15772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5755.exe
    3⤵
    PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41517.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
      4⤵
      PID:9656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39946.exe
    3⤵
    PID:11536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34917.exe
    3⤵
    PID:15892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52889.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33541.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26977.exe
        9⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        9⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        8⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        8⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18475.exe
        8⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52071.exe
        7⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14773.exe
        7⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        7⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
        7⤵
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
        7⤵
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10602.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31076.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        6⤵
        
        PID:15496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        5⤵
        Executes dropped EXE
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60785.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35195.exe
        8⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        7⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe
        7⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
        7⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10027.exe
        6⤵
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5794.exe
        6⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43292.exe
        6⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11214.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57661.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        6⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19819.exe
        5⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30879.exe
        5⤵
        
        PID:456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58820.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64085.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13120.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        7⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        7⤵
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37307.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36354.exe
        6⤵
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
        6⤵
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
        6⤵
        
        PID:11800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        6⤵
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        5⤵
        
        PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5898.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4722.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        5⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28579.exe
        5⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49139.exe
        5⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        5⤵
        
        PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
      4⤵
      PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        5⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        5⤵
        
        PID:11392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        5⤵
        
        PID:15744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
      4⤵
      PID:7588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4723.exe
      4⤵
      PID:12408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
      4⤵
      PID:16488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        5⤵
        Executes dropped EXE
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43281.exe
        6⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        8⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        8⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38001.exe
        8⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59488.exe
        7⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38478.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9783.exe
        6⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2294.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        6⤵
        
        PID:15660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        6⤵
        
        PID:15884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33733.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57550.exe
        6⤵
        
        PID:15896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        5⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        5⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51641.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        6⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe
        5⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58704.exe
        5⤵
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60991.exe
      4⤵
      PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7220.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        5⤵
        
        PID:13004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
        5⤵
        
        PID:8432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
      4⤵
      PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13282.exe
      4⤵
      PID:12620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
      4⤵
      PID:13628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
      4⤵
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36997.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13120.exe
        6⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
        7⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        7⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        6⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        5⤵
        
        PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8071.exe
        5⤵
        
        PID:12848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39285.exe
        5⤵
        
        PID:15668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15351.exe
      4⤵
      PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
        5⤵
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        5⤵
        
        PID:11372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
        5⤵
        
        PID:15960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        5⤵
        
        PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
      4⤵
      PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7687.exe
      4⤵
      PID:13528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
      4⤵
      PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14863.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
      4⤵
      PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60520.exe
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4022.exe
        5⤵
        
        PID:12224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40717.exe
        5⤵
        
        PID:15820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65319.exe
      4⤵
      PID:8480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50728.exe
      4⤵
      PID:12120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44601.exe
      4⤵
      PID:15768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3946.exe
    3⤵
    PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
      4⤵
      PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        5⤵
        
        PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
      4⤵
      PID:11676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
      4⤵
      PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41707.exe
    3⤵
    PID:8252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
    3⤵
    PID:11916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14381.exe
    3⤵
    PID:15836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39604.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39604.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46457.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29109.exe
        5⤵
        
        PID:3008
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 632
        6⤵
        Program crash
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23047.exe
        5⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1740.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        6⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39156.exe
        5⤵
        
        PID:744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        5⤵
        
        PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
      4⤵
      PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        6⤵
        
        PID:15576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65053.exe
        6⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36171.exe
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40867.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        5⤵
        
        PID:12476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        5⤵
        
        PID:14496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
      4⤵
      PID:13320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
      4⤵
      PID:2640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10255.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-328.exe
      4⤵
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        5⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40360.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30348.exe
        6⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        5⤵
        
        PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
      4⤵
      PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9228.exe
        5⤵
        
        PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe
        5⤵
        
        PID:12356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50291.exe
      4⤵
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-942.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13813.exe
      4⤵
      PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
    3⤵
    PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9752.exe
      4⤵
      PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        5⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50116.exe
        5⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
      4⤵
      PID:10044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44967.exe
      4⤵
      PID:13916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
      4⤵
      PID:14680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45040.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
      4⤵
      PID:10572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53188.exe
      4⤵
      PID:14276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17388.exe
      4⤵
      PID:15452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19042.exe
    3⤵
    PID:10000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe
    3⤵
    PID:12564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26795.exe
    3⤵
    PID:17132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46457.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29109.exe
      4⤵
      PID:3152
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 608
        5⤵
        Program crash
        
        PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        5⤵
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        5⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39974.exe
        5⤵
        
        PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
      4⤵
      PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe
      4⤵
      PID:13720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
      4⤵
      PID:15976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50276.exe
    3⤵
    PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16769.exe
      4⤵
      PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        5⤵
        
        PID:11780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-608.exe
        5⤵
        
        PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
      4⤵
      PID:8304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56155.exe
      4⤵
      PID:11936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
      4⤵
      PID:16016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2662.exe
    3⤵
    PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9990.exe
      4⤵
      PID:12340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
      4⤵
      PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47796.exe
    3⤵
    PID:7648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21258.exe
    3⤵
    PID:12332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
    3⤵
    PID:16300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
    3⤵
    PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16769.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
        5⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22345.exe
        6⤵
        
        PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        5⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40525.exe
        5⤵
        
        PID:15660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44184.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        5⤵
        
        PID:14568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22345.exe
        5⤵
        
        PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20323.exe
      4⤵
      PID:11664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1568.exe
      4⤵
      PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
    3⤵
    PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
      4⤵
      PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65003.exe
      4⤵
      PID:14236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22662.exe
    3⤵
    PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
      4⤵
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44548.exe
      4⤵
      PID:15228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-92.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-92.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13587.exe
    3⤵
    PID:12524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37237.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37237.exe
  2⤵
  PID:5240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
    3⤵
    PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
      4⤵
      PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
      4⤵
      PID:12304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
      4⤵
      PID:15928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54198.exe
      4⤵
      PID:4652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
    3⤵
    PID:10228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
    3⤵
    PID:14060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
    3⤵
    PID:7304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15374.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15374.exe
  2⤵
  PID:7176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48741.exe
    3⤵
    PID:14376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64146.exe
    3⤵
    PID:1348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
  2⤵
  PID:9864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8355.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8355.exe
  2⤵
  PID:12264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exe
  2⤵
  PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2460 -ip 2460
1⤵
PID:5636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3152 -ip 3152
1⤵
PID:6584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2344 -ip 2344
1⤵
PID:6920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3008 -ip 3008
1⤵
PID:7076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6252 -ip 6252
1⤵
PID:13968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 15048 -ip 15048
1⤵
PID:15912

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe

Filesize
468KB

MD5
3b2d20bc2a24d4ab86c7ec821314915f

SHA1
18786ec571d38301bb3d5d630df4e35441adf01b

SHA256
cebace2b5745870ae71a3b788b89a1e5e66f60bd82d74bae5586e0f9a62024c9

SHA512
61c4f378dffbb2acaa42748a7c603bb08dc0f11e38bca8327bc61010e07952a216492c578eeebcd7c2c0868a2fca54176921c5bfb35b2550cc0683dea4b6edcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe

Filesize
468KB

MD5
8099a329e1bfeb1db335c994230c5af1

SHA1
7a8b08138d9735c7f07b975c4c7db6f0e9e8c3e6

SHA256
c50945f3cdbde34471ba8fc994f545b93ff8837d986c92b57aa5602a448a46a5

SHA512
67208ac7802aff56e08ae87e699bdd3e3248f22a9da23d0ef5e0dfdf11dea0c281a75301a33dec0c87fbd70b537d0393cfa3986b2a45197cbab044ca5c9897a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe

Filesize
468KB

MD5
7e95632abc489268a602a28c22589092

SHA1
f468ba7f1b0ec7a19c94cdb9cde7813e963d5106

SHA256
45a76308dc0597898100cb26bbe7220d3c395563250ff24ec4f411391fde867e

SHA512
81ce2139a695417e3180187b3ebbfde079ca525151afa35daf0670f4047236e14a2b95d5a381d339833da04c099f66e1664170024a54df3048ea62f7761b32b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15699.exe

Filesize
468KB

MD5
2eac33471e83be21a11600a44dccbc17

SHA1
d1316377838fad847415cfc4db1fbc810b9da41e

SHA256
cd50c28fa6ee622a7b870cb74e011d5ba9418bc455ffe0a0030fc5196d0c0317

SHA512
b8b1d1622c2d5a4203589e912ecd16c4438d3292cba0597826b24e66cbfe3394544f3785d2caf7815f5f0a0b434b4719012c0573a359c9ace0fa3917990aa8fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15889.exe

Filesize
468KB

MD5
1ba86936c32f1ff44efd27e1e360b64c

SHA1
0fdac443185ce199106d315f5cf924973d6b1db9

SHA256
8cc32689922f421d9845ade544935ed1781e76fad75986164d2255607adff96a

SHA512
af18b463b978ac650326a2e95715e90cb4e98cd00e1cded5f7bf496cc69f986cab8b190f02a3480c3fe5ee25bbbac50fe0da243bf3573c9849bb1e9b678d02e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1590.exe

Filesize
468KB

MD5
f9c58dc32c3aca945da86ab6052dbc2f

SHA1
23fa3f027a3e3c78612781888ea26511ff1ab9c0

SHA256
759166f1e002fac2a83411e449e1cd5a984f64d8f51722fa3157400d1a459fd6

SHA512
57a14fcf12369c938af91238520a007ec5a285f2887d9e10a1945428a754bfc26b4b5765fbcbb7a8b8fb20d85007533df83d8f62457c914258fcee1f47747c77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe

Filesize
468KB

MD5
aa04cd5d50507f627df2aa28e2a43e6d

SHA1
a921d20cb32fc3da547ab4345a9a6a06d943d0e2

SHA256
883a3813753c646cf5c76b157ccdcc50baec76d4e4d1035908362b19e14d6e38

SHA512
a39769525765268881dda33cd0d6929ec5036877b00042ab3b891e1bfa8d57ebd4af8a5643173171ddd4354b7312bf79a99b98070d4427d4064b6ebc39947f3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe

Filesize
468KB

MD5
c333a7d193145d8800e7507ce0354924

SHA1
5d93855ed6ea577612456b8617f79d21af22d8dd

SHA256
967dd3caaf74e36eaf19d150e160c6843df6c9346a405d6f72eafe636091ccfc

SHA512
1fb9a64b18acd6cb0d752296185d043dc1411101277be0f72a459f69fbd7f4a3dae62310f2520d6ff8cf61814634f96ab8204cd9f3c6a465382d3942382299de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20387.exe

Filesize
468KB

MD5
1866e772806895c0f977609df80eed0a

SHA1
61482368e88627bb5045a297a2114c9aa8d0e480

SHA256
296dd8550e2c857be6493d231e1751029dbf419336d2055392dc7aab24993afa

SHA512
dcec71c24a1970642a7d097237bc19e371e56083dcb659f4f5bfaf0c7777449a0c8f7c005ba8c940e21c6d0d640cae8ee38e3b22f6c577683bf0dd8c499be0b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe

Filesize
468KB

MD5
a9589df0975a3411e7ccce1e40f336fd

SHA1
8c0fccd96db97527e57d4b1476a20bd0b16e3841

SHA256
dbe35ceefc6372595789aaeed571769c394545f61df7b7d4f973f2021c2ccb60

SHA512
4d5225cc341600b4a52b282d7102fb198a755f2cbe21458b1d7c40c18e57c015deda969629ec018dbecd19a261204811c51b57c1964acc3c331622e22e5d33e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26989.exe

Filesize
468KB

MD5
5a31b01ce904286fea6ade50df2198e6

SHA1
7cc247f5e7ef0c01fc7d2d22e7770eab0ff8a891

SHA256
c0b4c3921e8b4c998ef2f6c22df60ea0ac75f7c64ad73f70872597dc4db48b76

SHA512
d9ad9fc95ee0334718cb074f2a6ef647401cb63cf82e83dfcfec1cbc43495e55c36db8c5c3e75900ba9c27c3cd7e6be526dbd93f6aab6b370909b77eaea403d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28171.exe

Filesize
468KB

MD5
1327f38b66abf3a247d0ad02a5c38199

SHA1
9d35059726575022c5d60d91bf4e580b7b4754ca

SHA256
fa064accbb0bb6b4a1beaabdcca3fad5064a08f94c2888995ac2ff8a011296fd

SHA512
83115949a7c9b4abf4103591ee00ce15e9d1eecbae38c39d79b731d551285a1975646c0e89330ee7b26da06b89e828be2d94074bebb63357d362c289cb002f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe

Filesize
468KB

MD5
272c0a33b9d47ae81719ea5d16b660f4

SHA1
1571b9886f161c6eec0080637cd34c81ec15f1f5

SHA256
1589944afff313ce3826670625ff3a676fed29d5241df3f3def4bf3e5609d789

SHA512
c9315de7bb933f0e7e7971101417ec024d212e468ad1ccadb2d2e27c72f6ed999576f3e6bed5d18f30ff49051ec3d0d85bdd9a5a13852dc43e828e0e1bc7e5f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32779.exe

Filesize
468KB

MD5
03f5d1cd0d4653a97969fcf12439ff12

SHA1
7c35802310f4a4c26c13fb549805bda9aa6b0254

SHA256
55a66616d06df7dab35bf2399cef423d85e933f24f115213476598f179e52a2b

SHA512
158c8047d432b869ccb2b603364c7cf90941c035f64407e843e1169a4f156cd8969efa4c8f7bfb00b6438257cc99e095a950116d61d5d523a401ee0338ff173c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe

Filesize
468KB

MD5
c379119776cf58e5ff04d0e47a328087

SHA1
d1b4a1d4932e30b887c7fc6862d2f65b94318164

SHA256
c45afd2bd372029f88ae4ac332b3a5e12d69af1801917789d767c9f1dde09664

SHA512
42a8243e625c441700507bb90eeedb4489c4240bd8cb640d8640cc98e128198e7f49eb65f79a4426edcc6b2e8ff3f9c1a14c660d92eba4b7bb366c476a79910f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe

Filesize
468KB

MD5
c5c539afa832231365d15b1cf4069b78

SHA1
3e97f865144998207faa66ed578a194243fea126

SHA256
72a1f8dae868f81151409d090b5f832c62d7a489c77c224c20fe9dbef9ead6ef

SHA512
b4a457baf5d8fdbc229c89deefccc85d8a101d3e5840b1a7ecd6495ff097f651af59d287fb4165cefe94a795970cf42056c850e698ac978434b5e97a54116891

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35327.exe

Filesize
468KB

MD5
340064bd60b0416a6f5ba8861c479567

SHA1
ebd23c94f5a94f8f037a489933da0165440b7672

SHA256
db324dceb478dc83492fd12b325b9db5f0f888189224633ccf193424c884a865

SHA512
660fc2bc9d8af44995412306f924c49c1e8d6c22278b378835b28fadeaab999a1b27b4eb321b3e7974362ebba4f48eecec0f1d9f422734b16b7e281152fcaf88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39604.exe

Filesize
468KB

MD5
8bcb13bb910935c5fa80d65a06ef48ea

SHA1
eaff25c7c3e7c647c11a05731fafe390ce673e70

SHA256
6fc738e499b89afb8bf8cb058605afb3b94f6d9418ea0e7ecbb0bb37483b78ee

SHA512
7332364e0f40d1df1903ae59f6ce44e6fe30af7253588e9cb4fe07ca594366f6f8b5fbfcfed7e540c4f5a99492e789aab25b86b02793cd4aefcb9af2de2a4d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4212.exe

Filesize
468KB

MD5
9b6d08b20de4c49f65bdf4e77304aeae

SHA1
7522209ff774b7a6f8c2dcebe17746e2390347f0

SHA256
059c9ed3d5f80cb4d7b7a5b7971679bb90f38cc252d1f377b7e8f4340dc1a2db

SHA512
7259e4aca1c7f08dcc2718d1749beb36eaeb2e4e443219867febe1369a481b86f85b5e5a6b0c77bedcb519bdf3567609c94af7eeaea75664a60c9297fdca7fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe

Filesize
468KB

MD5
e25e91f69f9bd6e3b6ce7c4285f185de

SHA1
f2dc1e390b66e8286b6a8aeefb54d82c91d9b5c3

SHA256
e6abec0f937e8882ed3a26c78e153d365da06c68d10d92dffdd4f61db8d73671

SHA512
08a94aab21bf265bf4b3b4b6c62e65b19514dbf18aab2981fca5b5e9aec2b03edb3dc7fcb028037f2870fecf4889ce40a2b780b3752a9b68cbfa8b0aa5e63b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe

Filesize
468KB

MD5
933f0a946f48f60031e4c2ae85ea9fab

SHA1
b11e48929de789dcd96a436999d728e5816cc4fc

SHA256
a842b312f7f4edc05cd46c7ce3c0baf96b847e2971c0953ae67354d5a26cb279

SHA512
8429d04a2420f431ba2ae6d016de70d6651c7e9c0fcb2510a7adba213cd618229e5b0f2882807f365c190d7c8fbedf782588000e36d67bcc17b02e27a7796c2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe

Filesize
468KB

MD5
14806566ee2b69c1d101a0fb70af8af2

SHA1
df9089fc10952a7c6539ec9312ea158a02b0e81b

SHA256
1ed337659ac10f1c13e41f052ef13b8708d8c9dfd65ac9388f1d84f52a8ccd7f

SHA512
7eb5fb6444b50ef4c49cbd543ff71cc2685d03bc02bd637ce88c56dbc2a4a023227e97e39abf708d1b5579ce134091882eebfd6169b324aa125d6050c8622113

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe

Filesize
468KB

MD5
27650cf3d8f0c6d25fb14de2e5fd8199

SHA1
f77970091c39253f991592c96171641cdd02beeb

SHA256
e12fdfbc77d396b81b5244bc3d5e08c0ad00e2c69fb74e209fe39758c6c76a44

SHA512
03f81d36b80f9f9c2e399e22c5ce24463c756bec828893ce210fe58d632f07d6836000cc5809487d726b1b6d8912e8390c19a243f85e6079feebdb2b05684d4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe

Filesize
468KB

MD5
f2e6c77cfb708593e0a3140421700f43

SHA1
4bf68f70b25c4898540c4175b339016fe9468209

SHA256
2640f4be4a14ca0047ccc2de9e8b5d7bebc21e11f0a5530ce267fae9a3266792

SHA512
609764cfb399c3a7c339cfa771e0f05b23c1ca80d950650f82cd6cb89ca5cb5f7c3f65d0dc4ca28a90a4bcd5137f984770ddc16935aa553c3492e3692c95699e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51367.exe

Filesize
468KB

MD5
31c077c468c4cc816ac22609c467dc9a

SHA1
a4bae7769c85481f5b972e8049d5eb94642be881

SHA256
cca85639f936bcf93d01072647a7d1f5d9009d0a913970883d5f345320b543b7

SHA512
b4a3647eb1b9cd32a871bebcede66b34ba00f20a9df5a0e32de1bc69987d2982a8c3cfc7d1b866148c6215a797abc99de4e5d1b013e516640dca2657b5d5ff37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52889.exe

Filesize
468KB

MD5
bcfb1c5e1d2284c627bd2c10588c53fd

SHA1
af28b9acd22b600d9de1cc0b027cdf604a5283f5

SHA256
7693eb2a4b39a129b3b4ee38ea88eef8251567db218201516a8a55bf073fa281

SHA512
62f9249501a328471663bd4b1ab1d91ff7794aef6c0fd03f77b3fb90ccafd39942e5330593cbea617575acca140a444348a78789e184afe016b893b739ea3655

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54321.exe

Filesize
468KB

MD5
1f77cc71764882bd7331eb57621ca18b

SHA1
f8a1ed3cffaa31ad2fd193ab09480499cc5aadd3

SHA256
866a66bcae9ba3624f9c092608a372862b8652683f12b63f977556aefb00a14b

SHA512
1ab4c0f0fa8fee343a084c515a7c5d41c588ed42e69f8932173000ae3689c680614d255635b34d3c48a2c03156fbc67740b101e964f3cf3fd64fd38851ea89af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe

Filesize
468KB

MD5
548b7709f0e756bcee75c088357164bc

SHA1
48ae5c004ff7ca4463d82a4f5215579ce53569b7

SHA256
f7985058b70d2ce662943a0de1c62808db42c8bf4e95928a6216bcfb5a285783

SHA512
9b5a989be024fe56c57b8df933394572f68f3488b5796c5d50eef05417a886aa3b59840295d61964f395d0bad8dbbfb412dbc976c9f174567c840591f7f4034e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe

Filesize
468KB

MD5
ca2dd54f03a6c3baa54485921211a475

SHA1
74d22293c7ff6d87fcbeb99c24d066a340376e3f

SHA256
ce5ee2991aa44663cf5f13695bb41af41ffee8dab79a620e4df065dfdec1f56e

SHA512
b27d8445741e5fcc5ba7b3410eae22aa27de985a6685a2fa8c46cdad031e75b8d6d26de9f53c910aabf90d775de75df4001dec925923cc24197cd9b89b8f9e21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5940.exe

Filesize
468KB

MD5
79c391347652162214b9b922b3918474

SHA1
e7ef63b600b373e0ce89bc3c4474238e4ebe08ac

SHA256
0b25470480524393a3a924454fc76416abdad29a3b0f2cb5cac24a05dc280e8d

SHA512
c582a3030f2d03f512681f93a8b2bf63a125d72ef28225044da8214f3419fe3168a8c7f412fb975f0982faedb6fb598b1088e3f17dfa0628143cb039a28c871a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe

Filesize
468KB

MD5
64e52c66a2e1d01e64f9d91534dff9f3

SHA1
fd2badb5d93f68244d1c1b82a1a16d998ee81a76

SHA256
33b3756d4f21cab000d5f1d02cba48d1265fc57a27b9ac97825bf1d52e07daf9

SHA512
d28b88cb9162affc3a3f9a3bd3a336913b33a551d183dc147913adf5ef96d2726086621c70c56a7260c3ec7538f434d91eb637af0999e5719672129770d2d5f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe

Filesize
468KB

MD5
cc5e4bde4eb226f47cbd9719606a7b50

SHA1
29fb28905df7a5dd2b3c1aa275beef27cff096d4

SHA256
0f2dccd7d3d7257ce77b488311130a7b9625bd787b726ff2058c9c06a57e2e58

SHA512
a43363d421728294516b1087e2ebd015fa5bbc3bc4d8f837646def32deca55b9f4ee0d0eaafc0238526e2ff0faf485f114aaac6663e5ae9b0cfc00cc359b3e74

Download Submit
memory/408-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/464-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/516-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/632-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/860-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1000-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1132-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1144-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1188-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1236-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1432-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1484-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1492-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1588-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1676-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1832-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1848-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1856-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1872-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1900-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1968-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-65-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2144-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2528-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2812-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2944-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3008-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3048-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3192-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3260-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3268-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3312-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3640-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3708-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3712-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3720-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3748-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3768-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3996-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4044-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4056-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4104-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4268-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4284-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4320-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4484-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4500-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4660-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4840-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4916-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5124-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5156-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5240-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5252-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5276-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5312-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5332-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5400-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5692-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5708-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5732-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5800-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5864-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5928-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5940-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5956-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5992-564-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6008-563-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/8148-2549-0x0000000077730000-0x000000007773A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads