f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe
Size

468KB
MD5

83f3335a1e06de6f6731fc41bf569505
SHA1

8535a0fdd63b934730d32efe567d4aaaea4fa6e0
SHA256

f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f
SHA512

7879b574e2aadc644d4b73829dbe1abdd8ea77d394caed47d35e6d3a16343a68e052406f437edf9f6c3576d65f5e72d5758700f083466994fae64d2ed68f684b
SSDEEP

3072:ToA1ogYnI05ptbYnPz4jef8/ECxvPgpXcmHe6VsO8YiT/MpukQlZ:ToCom8ptkPEjefWcm28Y8Upuk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2900	Unicorn-30820.exe
3044	Unicorn-65254.exe
2072	Unicorn-61725.exe
2204	Unicorn-589.exe
4888	Unicorn-38092.exe
5012	Unicorn-8757.exe
444	Unicorn-27131.exe
4736	Unicorn-52198.exe
2812	Unicorn-7636.exe
2336	Unicorn-32463.exe
3060	Unicorn-44414.exe
764	Unicorn-40884.exe
320	Unicorn-52317.exe
4000	Unicorn-46452.exe
4056	Unicorn-17205.exe
2016	Unicorn-37071.exe
3516	Unicorn-37324.exe
228	Unicorn-7989.exe
1504	Unicorn-50868.exe
2656	Unicorn-28135.exe
216	Unicorn-47989.exe
1068	Unicorn-52893.exe
1664	Unicorn-7221.exe
1532	Unicorn-36879.exe
4884	Unicorn-39894.exe
4228	Unicorn-36364.exe
1012	Unicorn-22388.exe
4768	Unicorn-19588.exe
4612	Unicorn-12348.exe
4508	Unicorn-23854.exe
1756	Unicorn-47647.exe
456	Unicorn-47647.exe
840	Unicorn-59022.exe
1660	Unicorn-23143.exe
2660	Unicorn-41726.exe
1324	Unicorn-49894.exe
3880	Unicorn-693.exe
3624	Unicorn-41269.exe
4496	Unicorn-21668.exe
4864	Unicorn-18875.exe
1280	Unicorn-5140.exe
1684	Unicorn-35980.exe
1492	Unicorn-42110.exe
4804	Unicorn-25582.exe
5008	Unicorn-25582.exe
2516	Unicorn-25582.exe
5076	Unicorn-5716.exe
4616	Unicorn-46557.exe
920	Unicorn-40956.exe
4040	Unicorn-57492.exe
2600	Unicorn-885.exe
2680	Unicorn-23309.exe
2856	Unicorn-17443.exe
3340	Unicorn-17443.exe
1656	Unicorn-3708.exe
4592	Unicorn-3708.exe
2108	Unicorn-59318.exe
2476	Unicorn-52996.exe
4316	Unicorn-43366.exe
1088	Unicorn-18670.exe
4836	Unicorn-64341.exe
3584	Unicorn-31476.exe
5084	Unicorn-59510.exe
4608	Unicorn-3765.exe

Program crash 13 IoCs

pid	pid_target	Process	procid_target
5344	920	WerFault.exe	143
9084	5048	WerFault.exe	162
8252	6752	WerFault.exe	242
10680	5212	WerFault.exe	220
13060	8316	WerFault.exe	346
13528	8360	WerFault.exe	350
16676	8372	WerFault.exe	351
17220	8400	WerFault.exe	354
13396	13804	WerFault.exe	748
16272	8352	WerFault.exe	349
17692	9136	WerFault.exe	370
16700	17484	Process not Found	978
10524	7184	Process not Found	967

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28447.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18772	dwm.exe
Token: SeChangeNotifyPrivilege	18772	dwm.exe
Token: 33	18772	dwm.exe
Token: SeIncBasePriorityPrivilege	18772	dwm.exe
Token: SeCreateGlobalPrivilege	15044	Process not Found
Token: SeChangeNotifyPrivilege	15044	Process not Found
Token: 33	15044	Process not Found
Token: SeIncBasePriorityPrivilege	15044	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4708	f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe
2900	Unicorn-30820.exe
3044	Unicorn-65254.exe
2072	Unicorn-61725.exe
2204	Unicorn-589.exe
4888	Unicorn-38092.exe
444	Unicorn-27131.exe
5012	Unicorn-8757.exe
4736	Unicorn-52198.exe
2812	Unicorn-7636.exe
3060	Unicorn-44414.exe
4000	Unicorn-46452.exe
320	Unicorn-52317.exe
2336	Unicorn-32463.exe
764	Unicorn-40884.exe
2016	Unicorn-37071.exe
4056	Unicorn-17205.exe
3516	Unicorn-37324.exe
228	Unicorn-7989.exe
1504	Unicorn-50868.exe
2656	Unicorn-28135.exe
216	Unicorn-47989.exe
4884	Unicorn-39894.exe
1664	Unicorn-7221.exe
4768	Unicorn-19588.exe
1012	Unicorn-22388.exe
1532	Unicorn-36879.exe
4228	Unicorn-36364.exe
1068	Unicorn-52893.exe
4612	Unicorn-12348.exe
1756	Unicorn-47647.exe
4508	Unicorn-23854.exe
456	Unicorn-47647.exe
1660	Unicorn-23143.exe
840	Unicorn-59022.exe
2660	Unicorn-41726.exe
1324	Unicorn-49894.exe
3880	Unicorn-693.exe
1280	Unicorn-5140.exe
3624	Unicorn-41269.exe
4864	Unicorn-18875.exe
1684	Unicorn-35980.exe
2516	Unicorn-25582.exe
4804	Unicorn-25582.exe
920	Unicorn-40956.exe
5008	Unicorn-25582.exe
1492	Unicorn-42110.exe
3340	Unicorn-17443.exe
2600	Unicorn-885.exe
2856	Unicorn-17443.exe
2680	Unicorn-23309.exe
4040	Unicorn-57492.exe
1656	Unicorn-3708.exe
5076	Unicorn-5716.exe
4616	Unicorn-46557.exe
4592	Unicorn-3708.exe
2108	Unicorn-59318.exe
2476	Unicorn-52996.exe
4316	Unicorn-43366.exe
1088	Unicorn-18670.exe
4836	Unicorn-64341.exe
3584	Unicorn-31476.exe
4608	Unicorn-3765.exe
5084	Unicorn-59510.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2900	4708	f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe	90
PID 4708 wrote to memory of 2900	4708	f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe	90
PID 4708 wrote to memory of 2900	4708	f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe	90
PID 2900 wrote to memory of 3044	2900	Unicorn-30820.exe	93
PID 2900 wrote to memory of 3044	2900	Unicorn-30820.exe	93
PID 2900 wrote to memory of 3044	2900	Unicorn-30820.exe	93
PID 4708 wrote to memory of 2072	4708	f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe	94
PID 4708 wrote to memory of 2072	4708	f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe	94
PID 4708 wrote to memory of 2072	4708	f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe	94
PID 3044 wrote to memory of 2204	3044	Unicorn-65254.exe	96
PID 3044 wrote to memory of 2204	3044	Unicorn-65254.exe	96
PID 3044 wrote to memory of 2204	3044	Unicorn-65254.exe	96
PID 2900 wrote to memory of 4888	2900	Unicorn-30820.exe	97
PID 2900 wrote to memory of 4888	2900	Unicorn-30820.exe	97
PID 2900 wrote to memory of 4888	2900	Unicorn-30820.exe	97
PID 2072 wrote to memory of 5012	2072	Unicorn-61725.exe	98
PID 2072 wrote to memory of 5012	2072	Unicorn-61725.exe	98
PID 2072 wrote to memory of 5012	2072	Unicorn-61725.exe	98
PID 4708 wrote to memory of 444	4708	f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe	99
PID 4708 wrote to memory of 444	4708	f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe	99
PID 4708 wrote to memory of 444	4708	f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe	99
PID 2204 wrote to memory of 4736	2204	Unicorn-589.exe	102
PID 2204 wrote to memory of 4736	2204	Unicorn-589.exe	102
PID 2204 wrote to memory of 4736	2204	Unicorn-589.exe	102
PID 3044 wrote to memory of 2812	3044	Unicorn-65254.exe	103
PID 3044 wrote to memory of 2812	3044	Unicorn-65254.exe	103
PID 3044 wrote to memory of 2812	3044	Unicorn-65254.exe	103
PID 444 wrote to memory of 2336	444	Unicorn-27131.exe	104
PID 444 wrote to memory of 2336	444	Unicorn-27131.exe	104
PID 444 wrote to memory of 2336	444	Unicorn-27131.exe	104
PID 5012 wrote to memory of 3060	5012	Unicorn-8757.exe	105
PID 5012 wrote to memory of 3060	5012	Unicorn-8757.exe	105
PID 5012 wrote to memory of 3060	5012	Unicorn-8757.exe	105
PID 2072 wrote to memory of 764	2072	Unicorn-61725.exe	106
PID 2072 wrote to memory of 764	2072	Unicorn-61725.exe	106
PID 2072 wrote to memory of 764	2072	Unicorn-61725.exe	106
PID 4708 wrote to memory of 320	4708	f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe	107
PID 4708 wrote to memory of 320	4708	f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe	107
PID 4708 wrote to memory of 320	4708	f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe	107
PID 2900 wrote to memory of 4000	2900	Unicorn-30820.exe	108
PID 2900 wrote to memory of 4000	2900	Unicorn-30820.exe	108
PID 2900 wrote to memory of 4000	2900	Unicorn-30820.exe	108
PID 4888 wrote to memory of 4056	4888	Unicorn-38092.exe	109
PID 4888 wrote to memory of 4056	4888	Unicorn-38092.exe	109
PID 4888 wrote to memory of 4056	4888	Unicorn-38092.exe	109
PID 4736 wrote to memory of 2016	4736	Unicorn-52198.exe	110
PID 4736 wrote to memory of 2016	4736	Unicorn-52198.exe	110
PID 4736 wrote to memory of 2016	4736	Unicorn-52198.exe	110
PID 2204 wrote to memory of 3516	2204	Unicorn-589.exe	111
PID 2204 wrote to memory of 3516	2204	Unicorn-589.exe	111
PID 2204 wrote to memory of 3516	2204	Unicorn-589.exe	111
PID 2812 wrote to memory of 228	2812	Unicorn-7636.exe	112
PID 2812 wrote to memory of 228	2812	Unicorn-7636.exe	112
PID 2812 wrote to memory of 228	2812	Unicorn-7636.exe	112
PID 3044 wrote to memory of 1504	3044	Unicorn-65254.exe	113
PID 3044 wrote to memory of 1504	3044	Unicorn-65254.exe	113
PID 3044 wrote to memory of 1504	3044	Unicorn-65254.exe	113
PID 4000 wrote to memory of 2656	4000	Unicorn-46452.exe	114
PID 4000 wrote to memory of 2656	4000	Unicorn-46452.exe	114
PID 4000 wrote to memory of 2656	4000	Unicorn-46452.exe	114
PID 2900 wrote to memory of 216	2900	Unicorn-30820.exe	115
PID 2900 wrote to memory of 216	2900	Unicorn-30820.exe	115
PID 2900 wrote to memory of 216	2900	Unicorn-30820.exe	115
PID 5012 wrote to memory of 1068	5012	Unicorn-8757.exe	116

C:\Users\Admin\AppData\Local\Temp\f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe
"C:\Users\Admin\AppData\Local\Temp\f13c7d71e8f0611a2894f4567048b65e8f3b71ad4e5a1149261e5ac2bff3aa3f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23854.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        9⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        10⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        11⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        11⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        10⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        10⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        10⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        9⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        10⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        10⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53981.exe
        10⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34291.exe
        9⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        9⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        9⤵
        
        PID:18308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
        9⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        10⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        10⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        10⤵
        
        PID:18240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        9⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1132.exe
        9⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        9⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe
        8⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
        9⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exe
        9⤵
        
        PID:16636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:18156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        8⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50605.exe
        8⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        8⤵
        
        PID:18756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31476.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6630.exe
        8⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8789.exe
        9⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        10⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        10⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        9⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59341.exe
        9⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10997.exe
        8⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58279.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        9⤵
        
        PID:18192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        8⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6959.exe
        8⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38876.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        8⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
        9⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        9⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        9⤵
        
        PID:19260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        8⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53981.exe
        8⤵
        
        PID:18004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        8⤵
        
        PID:13412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9136 -s 740
        8⤵
        Program crash
        
        PID:17692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17172.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        7⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53070.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
        8⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        9⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        10⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6980.exe
        10⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe
        9⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8879.exe
        9⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8148.exe
        8⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        8⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        8⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18508.exe
        7⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19876.exe
        8⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        9⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exe
        9⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        9⤵
        
        PID:18492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
        8⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35340.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24190.exe
        8⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe
        8⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55879.exe
        8⤵
        
        PID:18420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        7⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        7⤵
        
        PID:18064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37812.exe
        6⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9830.exe
        8⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28621.exe
        8⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
        8⤵
        
        PID:18544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
        7⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        7⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        7⤵
        
        PID:17984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
        6⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        7⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51743.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20739.exe
        6⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4988.exe
        6⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36718.exe
        6⤵
        
        PID:18572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34238.exe
        7⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        8⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3348.exe
        9⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        10⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29284.exe
        10⤵
        
        PID:19196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        9⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38740.exe
        9⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
        8⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63006.exe
        8⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1667.exe
        8⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12997.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
        8⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        9⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        9⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        8⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe
        8⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        8⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52252.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3333.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        7⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54549.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        8⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        9⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47397.exe
        9⤵
        
        PID:16528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7467.exe
        9⤵
        
        PID:18404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        8⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        8⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
        7⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35709.exe
        7⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-635.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        7⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        7⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53037.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        6⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57237.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11918.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27395.exe
        8⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        8⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64277.exe
        7⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        8⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        7⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2927.exe
        7⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33219.exe
        6⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45990.exe
        7⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6452.exe
        7⤵
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21779.exe
        7⤵
        
        PID:17496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49069.exe
        6⤵
        
        PID:16020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12444.exe
        6⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
        7⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        7⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        7⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
        6⤵
        
        PID:14400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50504.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6683.exe
        5⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
        6⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27364.exe
        6⤵
        
        PID:19396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19580.exe
        5⤵
        
        PID:10928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
        5⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17683.exe
        5⤵
        
        PID:18744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-693.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34238.exe
        7⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1316.exe
        8⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
        9⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        9⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59440.exe
        9⤵
        
        PID:17412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        8⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59301.exe
        8⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37131.exe
        8⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32924.exe
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62702.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        9⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        9⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        9⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64054.exe
        8⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        8⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
        8⤵
        
        PID:18116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9830.exe
        8⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        8⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31395.exe
        8⤵
        
        PID:18728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        7⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
        7⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4149.exe
        6⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39438.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13805.exe
        8⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        8⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exe
        8⤵
        
        PID:18716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65398.exe
        7⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
        7⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
        7⤵
        
        PID:18704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe
        6⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12238.exe
        7⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        7⤵
        
        PID:17544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51757.exe
        6⤵
        
        PID:15660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        6⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5716.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24015.exe
        6⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        8⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        8⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        8⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        7⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        7⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exe
        7⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        6⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24190.exe
        7⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28045.exe
        7⤵
        
        PID:17100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        7⤵
        
        PID:16272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13509.exe
        6⤵
        
        PID:13132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19196.exe
        6⤵
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
        6⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        7⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        7⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64630.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
        6⤵
        
        PID:16044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28517.exe
        6⤵
        
        PID:18516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15348.exe
        5⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7467.exe
        6⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16131.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14845.exe
        8⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45710.exe
        9⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52934.exe
        9⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23803.exe
        9⤵
        
        PID:17552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        8⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24323.exe
        8⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        8⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
        8⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        8⤵
        
        PID:16936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47239.exe
        8⤵
        
        PID:18060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35164.exe
        7⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4828.exe
        7⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        7⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55701.exe
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
        8⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        8⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        8⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1589.exe
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
        7⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44453.exe
        7⤵
        
        PID:14204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
        6⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29021.exe
        6⤵
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45452.exe
        6⤵
        
        PID:16620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52325.exe
        6⤵
        
        PID:18636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        7⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        8⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        8⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26491.exe
        8⤵
        
        PID:19296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62710.exe
        7⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29285.exe
        7⤵
        
        PID:18072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        6⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        7⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        7⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23803.exe
        7⤵
        
        PID:18260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
        6⤵
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4475.exe
        6⤵
        
        PID:18120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12556.exe
        5⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49166.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        6⤵
        
        PID:13572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
        6⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53780.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exe
        5⤵
        
        PID:14284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25167.exe
        5⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24799.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8789.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12285.exe
        8⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        8⤵
        
        PID:16748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        7⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5740.exe
        7⤵
        
        PID:17288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
        7⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10997.exe
        6⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20734.exe
        7⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40821.exe
        7⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        7⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
        6⤵
        
        PID:11768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        6⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
        6⤵
        
        PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20916.exe
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45430.exe
        6⤵
        
        PID:13368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45700.exe
        5⤵
        
        PID:8172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
      4⤵
      PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
        6⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        6⤵
        
        PID:18372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
        5⤵
        
        PID:9924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20707.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
      4⤵
      PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        5⤵
        
        PID:10008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        5⤵
        
        PID:14140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
      4⤵
      PID:9956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
      4⤵
      PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
      4⤵
      PID:17812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43366.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26366.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18606.exe
        9⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        9⤵
        
        PID:16036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        9⤵
        
        PID:18416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32668.exe
        8⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        8⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52808.exe
        8⤵
        
        PID:18024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
        7⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        7⤵
        
        PID:18664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52302.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe
        8⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9492.exe
        8⤵
        
        PID:18124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
        7⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        7⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52444.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60318.exe
        6⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        6⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23708.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55583.exe
        7⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53508.exe
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        6⤵
        
        PID:15028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        6⤵
        
        PID:19108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        6⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        7⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        6⤵
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
        6⤵
        
        PID:13316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exe
        6⤵
        
        PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20501.exe
        5⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13805.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23803.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
        5⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18875.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35390.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10854.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13893.exe
        7⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44277.exe
        7⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
        7⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        6⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        7⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26772.exe
        7⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
        6⤵
        
        PID:16720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        6⤵
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        6⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5549.exe
        7⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
        7⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        7⤵
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52430.exe
        6⤵
        
        PID:12944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        6⤵
        
        PID:15732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34853.exe
        6⤵
        
        PID:17928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        5⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18932.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60868.exe
        5⤵
        
        PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43677.exe
      4⤵
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        5⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
        6⤵
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        6⤵
        
        PID:14932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
        6⤵
        
        PID:18232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17956.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        5⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36379.exe
        5⤵
        
        PID:18480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10876.exe
      4⤵
      PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40084.exe
        5⤵
        
        PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55007.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
      4⤵
      PID:11284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3413.exe
      4⤵
      PID:16080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3.exe
      4⤵
      PID:8632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46452.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28135.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59022.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19630.exe
        6⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        8⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        9⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8360 -s 620
        9⤵
        Program crash
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        8⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        8⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10997.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        8⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
        8⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17395.exe
        7⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58485.exe
        7⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24564.exe
        6⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31182.exe
        7⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18900.exe
        8⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20556.exe
        7⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        7⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        7⤵
        
        PID:18032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35716.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16524.exe
        6⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        6⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        6⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-678.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49166.exe
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
        7⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4846.exe
        7⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23627.exe
        6⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        6⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        6⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-827.exe
        5⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
        6⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56365.exe
        5⤵
        
        PID:13388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36740.exe
        5⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
      4⤵
      Executes dropped EXE
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35582.exe
        5⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
        6⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6752 -s 632
        7⤵
        Program crash
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        6⤵
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19420.exe
        6⤵
        
        PID:15092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44527.exe
        6⤵
        
        PID:18332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51197.exe
        5⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
        6⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5445.exe
        6⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38780.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47644.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
        5⤵
        
        PID:13492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        5⤵
        
        PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2939.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        5⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
        6⤵
        
        PID:18320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        5⤵
        
        PID:13804
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13804 -s 436
        6⤵
        Program crash
        
        PID:13396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64925.exe
        5⤵
        
        PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
      4⤵
      PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
      4⤵
      PID:13604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22379.exe
      4⤵
      PID:1312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41726.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        8⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        8⤵
        
        PID:14236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
        7⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49628.exe
        7⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17292.exe
        6⤵
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29532.exe
        6⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64357.exe
        5⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        6⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45238.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        7⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49980.exe
        6⤵
        
        PID:15708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        6⤵
        
        PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21883.exe
        5⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exe
        6⤵
        
        PID:17944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5061.exe
        5⤵
        
        PID:12880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        5⤵
        
        PID:212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4149.exe
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21270.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63662.exe
        6⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6478.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        7⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
        6⤵
        
        PID:11800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        6⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19876.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
        5⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        5⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        5⤵
        
        PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7459.exe
      4⤵
      PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        5⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe
        6⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52341.exe
        5⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        5⤵
        
        PID:18220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
      4⤵
      PID:9992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51020.exe
      4⤵
      PID:13580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
      4⤵
      PID:17452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57492.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58288.exe
        6⤵
        
        PID:17684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6773.exe
        5⤵
        
        PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53820.exe
        5⤵
        
        PID:13532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
        5⤵
        
        PID:17484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
      4⤵
      PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        5⤵
        
        PID:15108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
        5⤵
        
        PID:17520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
      4⤵
      PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50142.exe
      4⤵
      PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
      4⤵
      PID:7840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25020.exe
    3⤵
    PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
      4⤵
      PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        5⤵
        
        PID:8380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe
        5⤵
        
        PID:15076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
      4⤵
      PID:9672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
      4⤵
      PID:13672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
      4⤵
      PID:17508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
    3⤵
    PID:6512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
    3⤵
    PID:12284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
    3⤵
    PID:16532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46724.exe
    3⤵
    PID:18624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8757.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7221.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25582.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8877.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        9⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        9⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44453.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        8⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
        8⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        8⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        8⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58375.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40260.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29613.exe
        7⤵
        
        PID:16508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30620.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        7⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24190.exe
        8⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
        8⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13893.exe
        7⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        7⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61837.exe
        6⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16231.exe
        6⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        7⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59830.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        8⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        8⤵
        
        PID:18596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        7⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        7⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        7⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11973.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        6⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        6⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23014.exe
        7⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        9⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
        9⤵
        
        PID:18040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40084.exe
        8⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53383.exe
        8⤵
        
        PID:17476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13893.exe
        7⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
        7⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        7⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        6⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe
        7⤵
        
        PID:18172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        6⤵
        
        PID:12204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe
        6⤵
        
        PID:15744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39135.exe
        6⤵
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
        6⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19675.exe
        5⤵
        
        PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1724.exe
        5⤵
        
        PID:13504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27294.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52893.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25582.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57237.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26022.exe
        8⤵
        
        PID:13356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8400 -s 600
        8⤵
        Program crash
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
        7⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3333.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39135.exe
        6⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13805.exe
        7⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        7⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7275.exe
        7⤵
        
        PID:18020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        6⤵
        
        PID:18464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
        5⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9830.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28621.exe
        6⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55879.exe
        6⤵
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51757.exe
        5⤵
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        5⤵
        
        PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52654.exe
        8⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
        8⤵
        
        PID:17556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        7⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        7⤵
        
        PID:18364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17572.exe
        6⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59165.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
        6⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        5⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        6⤵
        
        PID:16200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
        6⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        5⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33052.exe
        5⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
        5⤵
        
        PID:17428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        5⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25871.exe
        6⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        6⤵
        
        PID:14124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exe
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        5⤵
        
        PID:13800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21483.exe
      4⤵
      PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        5⤵
        
        PID:9520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40084.exe
        5⤵
        
        PID:13896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21203.exe
        5⤵
        
        PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
      4⤵
      PID:14832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47859.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40884.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25582.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
        6⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        8⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
        8⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        8⤵
        
        PID:17260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41164.exe
        8⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57308.exe
        7⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
        6⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
        7⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        7⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        7⤵
        
        PID:19132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27628.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50142.exe
        6⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20427.exe
        6⤵
        
        PID:18168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30620.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        6⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42460.exe
        7⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        7⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
        7⤵
        
        PID:17536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63758.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
        5⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        6⤵
        
        PID:12604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        6⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41477.exe
        5⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25598.exe
        5⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        8⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64973.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        7⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        6⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe
        5⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7405.exe
        6⤵
        
        PID:17392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14428.exe
        5⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        5⤵
        
        PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
      4⤵
      PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exe
        5⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58958.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        6⤵
        
        PID:13900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36477.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
        5⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        5⤵
        
        PID:13616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
        5⤵
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39661.exe
      4⤵
      PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7822.exe
        5⤵
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49824.exe
        5⤵
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36115.exe
      4⤵
      PID:12272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62741.exe
      4⤵
      PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21341.exe
      4⤵
      PID:9032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22388.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe
      4⤵
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27710.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        6⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
        7⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8316 -s 640
        7⤵
        Program crash
        
        PID:13060
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 636
        6⤵
        Program crash
        
        PID:10680
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 724
        5⤵
        Program crash
        
        PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5627.exe
      4⤵
      PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17342.exe
        5⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37542.exe
        6⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28621.exe
        6⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55007.exe
        6⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47822.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24323.exe
        5⤵
        
        PID:17396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64816.exe
        5⤵
        
        PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe
      4⤵
      PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
      4⤵
      PID:11912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65189.exe
      4⤵
      PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27222.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        6⤵
        
        PID:18212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exe
        5⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        5⤵
        
        PID:13952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
        5⤵
        
        PID:19232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
      4⤵
      PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        5⤵
        
        PID:16348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23611.exe
        5⤵
        
        PID:388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25653.exe
      4⤵
      PID:12788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47127.exe
      4⤵
      PID:19436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
    3⤵
    PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37134.exe
      4⤵
      PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        5⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7405.exe
        6⤵
        
        PID:16848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        5⤵
        
        PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
      4⤵
      PID:9368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19420.exe
      4⤵
      PID:15084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37427.exe
      4⤵
      PID:18288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
    3⤵
    PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
      4⤵
      PID:10224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
      4⤵
      PID:14788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
      4⤵
      PID:18252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25359.exe
    3⤵
    PID:9324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
    3⤵
    PID:16116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
    3⤵
    PID:18648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27131.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27131.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32463.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12348.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59318.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2022.exe
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
        8⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        8⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45700.exe
        8⤵
        
        PID:18228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        7⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
        7⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        7⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
        6⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        7⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29284.exe
        7⤵
        
        PID:19284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        6⤵
        
        PID:11748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30189.exe
        6⤵
        
        PID:15608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        6⤵
        
        PID:18532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        6⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe
        7⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        7⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41412.exe
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        6⤵
        
        PID:16684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        6⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        6⤵
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        5⤵
        
        PID:12232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50605.exe
        5⤵
        
        PID:16572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
        5⤵
        
        PID:18688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35686.exe
        5⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        6⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
        7⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34484.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        6⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        5⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        6⤵
        
        PID:17360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        6⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
        5⤵
        
        PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        5⤵
        
        PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
      4⤵
      PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50894.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
        6⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46372.exe
        6⤵
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31324.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11500.exe
        5⤵
        
        PID:14868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        5⤵
        
        PID:18300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21483.exe
      4⤵
      PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58901.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        5⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exe
        5⤵
        
        PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exe
      4⤵
      PID:12124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe
      4⤵
      PID:15844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
      4⤵
      PID:2464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36364.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-885.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57237.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        7⤵
        
        PID:12556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8372 -s 608
        7⤵
        Program crash
        
        PID:16676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
        5⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-422.exe
        6⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        6⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        5⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        5⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42460.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        6⤵
        
        PID:13652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
        6⤵
        
        PID:17528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23627.exe
        5⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        5⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        5⤵
        
        PID:18656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
      4⤵
      PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        5⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        5⤵
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29285.exe
        5⤵
        
        PID:18076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53037.exe
      4⤵
      PID:9976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
      4⤵
      PID:15420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
      4⤵
      PID:17716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57237.exe
      4⤵
      PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        5⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        6⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe
        7⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65396.exe
        7⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        6⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38780.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        5⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        5⤵
        
        PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
      4⤵
      PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29021.exe
      4⤵
      PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45452.exe
      4⤵
      PID:16552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
      4⤵
      PID:18584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
    3⤵
    PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
      4⤵
      PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        5⤵
        
        PID:10168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        5⤵
        
        PID:14800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        5⤵
        
        PID:18204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
      4⤵
      PID:10920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12891.exe
      4⤵
      PID:14748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
      4⤵
      PID:7784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exe
    3⤵
    PID:8060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20924.exe
    3⤵
    PID:11920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
    3⤵
    PID:16496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64388.exe
    3⤵
    PID:18524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52317.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52317.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39894.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42110.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37134.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21647.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
        7⤵
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        7⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1812.exe
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51516.exe
        6⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        6⤵
        
        PID:16184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        6⤵
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
        5⤵
        
        PID:15372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42223.exe
        5⤵
        
        PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7355.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        5⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe
        5⤵
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37837.exe
        5⤵
        
        PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
      4⤵
      PID:13888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
      4⤵
      PID:6280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46557.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59349.exe
      4⤵
      PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        5⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        5⤵
        
        PID:16112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
      4⤵
      PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56463.exe
        5⤵
        
        PID:14676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3333.exe
      4⤵
      PID:12384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
      4⤵
      PID:4808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
    3⤵
    PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
      4⤵
      PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        5⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64869.exe
        5⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52127.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23627.exe
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
      4⤵
      PID:16072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
      4⤵
      PID:8820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31685.exe
    3⤵
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5165.exe
      4⤵
      PID:12040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
      4⤵
      PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23803.exe
      4⤵
      PID:7928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48692.exe
    3⤵
    PID:13108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23142.exe
    3⤵
    PID:18008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19588.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19588.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49894.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42406.exe
      4⤵
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        6⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        7⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
        6⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40820.exe
        5⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        5⤵
        
        PID:13056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        5⤵
        
        PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24180.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        5⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        6⤵
        
        PID:14852
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8352 -s 608
        6⤵
        Program crash
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32533.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45700.exe
        5⤵
        
        PID:18284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
      4⤵
      PID:8164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24190.exe
        5⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54413.exe
        5⤵
        
        PID:15592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        5⤵
        
        PID:17580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
      4⤵
      PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53655.exe
      4⤵
      PID:18264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24076.exe
    3⤵
    PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
      4⤵
      PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        5⤵
        
        PID:14220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
      4⤵
      PID:11252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
      4⤵
      PID:15220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
      4⤵
      PID:7320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
    3⤵
    PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
      4⤵
      PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29284.exe
      4⤵
      PID:19156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
    3⤵
    PID:10852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62364.exe
    3⤵
    PID:16692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53669.exe
    3⤵
    PID:18360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 636
    3⤵
    - Program crash
    PID:5344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
  2⤵
  PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
    3⤵
    PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
      4⤵
      PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30758.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21116.exe
        5⤵
        
        PID:19164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35886.exe
      4⤵
      PID:7528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
    3⤵
    PID:9380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
    3⤵
    PID:13548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
    3⤵
    PID:17464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exe
  2⤵
  PID:6472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
    3⤵
    PID:15448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
    3⤵
    PID:19424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
  2⤵
  PID:11292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe
  2⤵
  PID:16564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28309.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28309.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:18452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 920 -ip 920
1⤵
PID:5208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5048 -ip 5048
1⤵
PID:8472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6752 -ip 6752
1⤵
PID:7640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5212 -ip 5212
1⤵
PID:10120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 8316 -ip 8316
1⤵
PID:6660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 8360 -ip 8360
1⤵
PID:14272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 8372 -ip 8372
1⤵
PID:17100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 8400 -ip 8400
1⤵
PID:16504

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 340 -s 11968
1⤵
PID:13792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 8352 -ip 8352
1⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 9136 -ip 9136
1⤵
PID:6632

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12348.exe

Filesize
468KB

MD5
c50a204132bed6a7dbecb3715f0d9008

SHA1
25d3f6f8134297907d2ae2cf23d656437dd93012

SHA256
99bc6a754ee9da416b5ff2c929e6041ddbacac0dfaec0610b9f8cd87d62e7e9a

SHA512
2d36775c70b2e78c34c3f205ef496ad1ed3576c003575cf02a28bb7c19296631399094e52f93f8a00d95fb7981a06729739a96d79ccd646584db2cfcd99fc805

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe

Filesize
468KB

MD5
16afc13b341c0d56e77f82d7f41a36fc

SHA1
b2fd4c20559c2a0f7f0bcbe234f7c30a9cfb6292

SHA256
bb00e94d7452e62931079c32f1d4bb4953488239476352ba0ef8329a396f1470

SHA512
b686ccaabbe5f68b2ed7237657380373be7a5339ee52012e9473ba717fc957431d7bd03e192c7ab890f5d3bc6bde7ec01a363baae4af6d517beb8e7d14259b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19588.exe

Filesize
468KB

MD5
3a311942a498f3676aef106693a1a7af

SHA1
bffc9d48683d7922f148da0a29bf31d4dc452daf

SHA256
46839670c3e8377a50f80229483d3a3644141de8dbab4c074de217f9093fa238

SHA512
ea3f81fd0ff01ea6ca35c791278e923a32d8a8d8fb381ca9854665894de8619ce6bd3061a6a01d12561a9c9f807e7b8a91850a1fefdd39e0476936a88892614c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22388.exe

Filesize
468KB

MD5
273a57c987875ade5a455adb2cbc5eaa

SHA1
e0868c0b7c85fbe8019251bafdf66172b86f9d1a

SHA256
7bbdeb15a78b97796463f40033f0b66736303997e8ebfc6891e57c59459f81de

SHA512
542c7a7b6ffafe241f439af64ffbfa12374a7236346d231ad267e31fd0d9ff57ae4c3ef65e779c4bdf6031e4376e588cd8da1a26ba577bf4f7cc1fac3a7a52e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23854.exe

Filesize
468KB

MD5
4eacd3835aba7a07ff05a57728caa571

SHA1
d9f328cc433995cd77203b274885d1131a160823

SHA256
08872d85f9e7bb92253c252bcb40cd669c5fc96795c7728661f6491bd3564bb0

SHA512
657c79bfc038be9cbb5f1929b0e840f9dab1a9f570413d5984dae248a936ad0e021b8475a30abd9a8a4e30b3f6300e448d02d7368ee5d6eecc5c86c539aece8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27131.exe

Filesize
468KB

MD5
d12f8a775cfa00f446210e7a9eab42c3

SHA1
bb9f454d64d3a42ca6cb8d43ff044ee8a2616435

SHA256
eef7f19e41ef0f89c670dc7439dc44a0a485dc9226b24d185434731502018420

SHA512
37d383cca7640b0f6887840bdbeadde7a31917938f219933969271bbb6217f7466c840f6d8111e20f23262a0260df8b9c7447beed9f0ff333b937b026097bec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28135.exe

Filesize
468KB

MD5
862be57e98ea65a6a2562b8476042ac8

SHA1
2a50355a61f13f628d39fb207cd23f68e8b2d7e8

SHA256
2dea4b1fd41ad97292866f4781c969ab957ce0a9e708eb44c68b98b38e78bafd

SHA512
49b0d6263b8189195514ec507e37175439f2154975eee9c4512f186c014f5f51102b71c5c6acf1c287d1f899b9fe202edcf7e8c3c22a858d57341acd7307b9af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe

Filesize
468KB

MD5
f4babc9b7f561be0e8bd5420c635e9fb

SHA1
b14d46143b8897b16981beb43c56dee538c6d50e

SHA256
d93bdc1096a8f3ca63d277b6260853644a5384904123a7c7b8664f806fd5e735

SHA512
c30541cf8d5dd06e00e3007cec6dab8c92d02dba39b5fb588065ca0440b5176517a4c0c1f6e0362412824f86fd07ca57f0f1ca6db0a17fd9720f09673b176e73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32463.exe

Filesize
468KB

MD5
00356f6190eb69f87cd7ccdb1bd6a271

SHA1
33d984da081120fe8e04cf188eb6ef88162745eb

SHA256
21f600a112fb606537776ea2f31c03a440182a3a6b9e06ee90e9aabfc70b1930

SHA512
39ec733030334de8bbdb9d5a15a900533caa6290c5bfab9289020b294c9ed5b9ed088f986199f55d0fa0875cc00370a2e73d138f584363e3037f8b86309fcdb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36364.exe

Filesize
468KB

MD5
33a1a15b6fd4ff4f23453bdd98d5d406

SHA1
8e6b012158ff1fe32668b338b12ab1481fa80607

SHA256
bb81ad2a3e5afa8f7a89221e489e753340ec521383bf71babfbaa5ac27e5e079

SHA512
7115b2d6d35e94aeb35cbaf62a65d08ab3e7763261d3631324dc2b8d9dc5223df9ac235c4175e51f0f2596f877b99b26a44e26c3716ddaff17737060123891e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe

Filesize
468KB

MD5
adc46da90d021a2f38945191fa740005

SHA1
67dcfc574d5f2c39e8c30004586525801871db77

SHA256
82f65d50e8d11dd771b9b12dda1aa7f6c20db0cced1423d001c8441907f82169

SHA512
aedaa1084d4bcf4dbbeed92e4a387b694f4e42af485e8ee4cfada5190850a50ea56c9c956c5b880ba3092cc609802de41191ab3e06bbe7fdce92b72c04ad2e1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe

Filesize
468KB

MD5
b4c2a6d7fe118ba33f4c3d6eb7c68355

SHA1
635bbccd6a8b13402a975d432868abbad7d61942

SHA256
7b8a4ecb25bc583a8044a0c95da27e9dcfae19be62e2707acc7477fb9bdb4b8e

SHA512
bf3c628fac48a55ac35a7aee791586d92642863b5af41e399abc06417faa11afb577e7d84ffd83988e5bc8dc5696c9a5c00cd70455be45a795e93e66a4f8ba26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe

Filesize
468KB

MD5
a505cce130da75243319bb4890813939

SHA1
d5b79e0a41bb68e43f6d24f1770b17c97d8b9686

SHA256
7fc2c3f372b16044705f2b1a03461718d91529dac0421f2bb608de89191b39ef

SHA512
a864606407008e479209b206989db07bc956c10c2b217fee336266a357a4208116f20d4665d67abe39c0fc6396557ddba7a6b89762ce3e574c3d6b66b371897c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe

Filesize
468KB

MD5
23d1467a4fa22fcc10a83838baa5e25e

SHA1
18577be82fb791329152d231141e002371dd8a51

SHA256
57e80fb911c107f99f0666640b084ebded55e1788f6e8fb50286bf4f2584c617

SHA512
b17952c668607af45583cff5d170dbd011524922c0df14f051abf5763054ad11426de1e009381beb1154caf52153f10c16a2b08201548765c151602c944bcdbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39894.exe

Filesize
468KB

MD5
abe257e0ee35b9fad112bb660061d1f2

SHA1
a53daf4a14a26f3eae17c82f1d593094e4acfe20

SHA256
f2d2da45477e3ecb2b008bb816bd060b1d30d441b8143a879e9ea1cc11798d7a

SHA512
361d5e4d79937163712ac4efa5e6cc57c1cef816fba6beda509248f67f10a470364da5e7136517cf6457ab307718246dc67b14143ca2321548a75f647e8590ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40084.exe

Filesize
468KB

MD5
59a5ec234541f5b35e2d8adb55539528

SHA1
9ca1a7c9cd4722b34241ca9dc89b4ad14b57796e

SHA256
4af23e0a9d290d6c170385d0dc5f78adae61c8cd9432ceeee04df2303ad4ebfd

SHA512
f7030453a99b3a378da6f3ec0819fa0c6c5dd54503e601f1cabc263f2db4428f4343202d3a0b447c4495d27634dca0f660d47fe26fdcf1088134cd53dedce6e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40884.exe

Filesize
468KB

MD5
c3d58b06f7bb1d689083f2c294cfe10e

SHA1
ef11b5584d1ebbed69579497fb3ba3864a384061

SHA256
f58ef584017499ba0455559352627726c7a78732922f421712dc18899b5e0325

SHA512
3d8d7100a85cdd3cccf5cfa55c7cad502f75046ff9a185af572d7991f3ed1ee04e95bf39755911284ff8d1cbfb0a23232f91f966b7c95122f57af7bfacaaa0d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe

Filesize
468KB

MD5
e1cff7834d579da58765b51f79b1a690

SHA1
101dab4a0bc0cc6fa1f3ac1ce57172b55d5ce868

SHA256
63a842cbb25f40558e26a97327cd178a8cdd8d1e7f0f5225f8ee4a2af27cb24f

SHA512
1d2dc7c8bdfecc72ddee166ff8c58cc3118f4b1b3993299c70104c879fc72fa4cd39ded889390c5d02e6e8ab1c9fe5ad3141af1a5d78c004b72ecc0ce4fed940

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46452.exe

Filesize
468KB

MD5
88129836c554fe531657f97106c51595

SHA1
801158092f79ad63ca52653110b47ad82f4eeb05

SHA256
4296fdbe1086cffebfc803027f99fe08d54d4cc0db2c93d25770cd88dac3b560

SHA512
74dcf75b5d5b5d3430d4c83910a8785b48a2435b289f52fedb96d71d72b551aeaab760a430116b5d23f1adacbd704d497f667ee86be8f7e1f3d2c97c1af186fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe

Filesize
468KB

MD5
838e1fd104cabfca7533bbd172e08979

SHA1
ccfc37c27fc99783a9e27cd183ec93a04ccdcd83

SHA256
e0f63a12d2b8287568bc4313b764dc2b6dd3f33b08545e6dfe8a35c31157d4d8

SHA512
bba4f8fc31807643bc57e15d967adbe887b76629bcbe12e76117547a9dd19a2630a386e71f9cf8634ce09fa3bc8111c86ed58717da199b5ea6def129415bfb7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe

Filesize
468KB

MD5
c1da4e4c921514a99c6fa18d215904bd

SHA1
e9860281fd56ff08b73bce5bd7096cbb8d6a8592

SHA256
3626654e6227b74ffcd7e1c690b79430a63fa860155ebcb832fe379aa993b652

SHA512
02558d4378a65de8d09fcbe6f2c56b83027b8efb968431eb548f60c22487e83c14c43389735e10b13a3fe75f11948a916aec8baa007bfd9a2aba5c0ca3fbd28c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe

Filesize
468KB

MD5
f1a4ae13be14731c6f9e2b61942e4304

SHA1
8bfb07244e33f2e637b4a4b0c680698cd61bbf73

SHA256
f0d1f46aa0ecf35f351dedf54f5e5a3c3a13e8d66465e352387aceef2454e3f5

SHA512
e7386d5b24eab993868e4fe528767b992847191d1eede6a2dd881c13294b9dc9281aaf567d8e22363887c797b382ce6eac7b426d8ec93ecbfa7646923ad44181

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe

Filesize
468KB

MD5
4071ab2d75ed1b2e08047eeb803b1131

SHA1
cdaa5bf4abe735420a755cfb9e1ee3ecdb3c155c

SHA256
27cd60c53209e3367c578a8291b67432b8a1c5bf4ecaa62d0a348f0a43865f5e

SHA512
5215278ac32d9a97e679e6f3dc32176f2bf75612e8dd31746b9e97d80b35b88832f5c130020c0228bb4f6c49b293cbc8b15946f3ffa4520157f9dc74a125839e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52317.exe

Filesize
468KB

MD5
7e3b95ba790452e66223c69081e4f552

SHA1
b8194ea35c422a7c0e4146f376d40d71107b0ab3

SHA256
298f2b215865d085dfce43b425cc11f838aca9e541bdb37979833dc22daf85b6

SHA512
a686b7cafb9a78a76777c7248174ff747b0f8b49d8bb847bb927168b4b2c84b9e658bce6af033f8064f2b04fdb1c7009102337d6819b733367a1910ae5b58331

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52893.exe

Filesize
468KB

MD5
b9c3e648ce497429c460fd4116210f92

SHA1
49b92639ecde473b8da7c9eaefcb22b311c9eab7

SHA256
d4eb02c538d646bfda21d3bdb97433d0c22975f52e101a5c270fde934d1d2ed9

SHA512
97acfa3647595d6643c5b0db5fa8d7ecb53fcdc0bf4c03dce325dfc44f72767d56a0ec357dd667f5c6aa99f11e87d858f68462fbfb2b703e67ceee29f35d3781

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe

Filesize
468KB

MD5
f3d06633e3afcc05d249eb473bc38bb2

SHA1
08ec153d4470d6297a7fa29817885ef4d2da6252

SHA256
563e1b6e990db23fbc3448de155cc91276010e163816d7b64ac1ce629988c17c

SHA512
a6ae141bbaa6ad585deadac667312d67946505b8bf53cbbb1ec39db01b0df73f6212ad704781c84b8cfd26368bf2f28abe19d2c7c258404e70ebe4fdb61da4c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe

Filesize
468KB

MD5
9c1d95822e57da3783908ee43c3dd55d

SHA1
45df74698792d2902f5673d86d555c3a04b014ff

SHA256
21a58a08779ae52307a464cdbadb20af1ce65657fe4924e455fe620317138792

SHA512
7ea09c26133b2997db2719013b12064748df2471d1b11788cac81995ee2892249a6314f7b12dd17be155195c541ebbfa2c5ef4ad5b958a50045b5f9f82a84124

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe

Filesize
468KB

MD5
ff5b4d0f338831f681d8731898d32048

SHA1
039609b5321968c21b5bcb5397ed8f5690bf4559

SHA256
e45827480e49e87723a00631df3ed3e55ecc8a53c9b056ba0ee8f09031f69250

SHA512
aff5ee5651b855449ef8d08d7188efafb027a1acb902830802d0916f6d8ce2ba360c4b6ab1498d63f6e24b072bc2c94ba1b43150792a60182c1d99fc1028e3c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7221.exe

Filesize
468KB

MD5
bd9b323b2d5ed738f06b6efb87811988

SHA1
b48220623744cd2ab077f57ae55fabc0ddf2605d

SHA256
a33c8b9962e36f79369340c46536f0bc193fb86fd7555f9f4a180b671b1cdf87

SHA512
bf7acd853c4ea5f92e4964d55887e59febdb2309f8178b8db263d4ba7f5cbf55db8bd19b685f6e6e356a19db8f3bcefaf338fb3c83d729bd529fded9d7d27848

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe

Filesize
468KB

MD5
96521a59513dc0b5669322c3026dbd84

SHA1
d98d7c7422166be06d5b14625d13ec907e465686

SHA256
fd13c5c30683682264ecb3778f5a813b815aa452d4ddcf88170326894516b75c

SHA512
78d455ddf204376d1771106bf2d3e6f63282b67465bc899d5ce9e3f6005248affddd1f0cd11853f63b36c03a3d1d59594404aba1272c3d7c550ce3a2d8af61ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe

Filesize
468KB

MD5
55ebb16b0ceec7c44c17ec83ab8c095c

SHA1
2e5e320fe0654902a5088e0d04c955179d5707d1

SHA256
ff31d06640f2a770e479f9affc00204eebedab5db88ed0e4e7dd381abc2a9012

SHA512
36b8881f5d358b887ac0437c07724d387f2577b627d553ee384006b330b0f61a809ba217a2ff0bbccec3825e3310da731f976d9edd372faf3fc5317a59bf6653

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8757.exe

Filesize
468KB

MD5
17c9b731cb5adf627fe1fb752aff6187

SHA1
ca6b277136470c2467ef8a272f941f3daaab3be9

SHA256
2e4bfdb2f05d36e4955c09b0147e85946ca8bbb05b6e00c4d557cc2081cd4b73

SHA512
2ddc9304cc671b44b630bb0c0e57483fbc62116c23fdf5539199b46405ec6c5a3658dc8b537d1b03f8c13ce852f52ba0f8630ee5411ad839a2c0f91133340dc7

Download Submit