6fd50f20efa69f76e2da2e4a43b24366d724a2625cfa49aae652b2203c96742b

Analysis

max time kernel
119s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76aa578a7b14dc9a15b535d43ccc11e0N.exe
Size

468KB
MD5

76aa578a7b14dc9a15b535d43ccc11e0
SHA1

7fc0a4a2f5e245d9bb47406eee6e3627de91805c
SHA256

6fd50f20efa69f76e2da2e4a43b24366d724a2625cfa49aae652b2203c96742b
SHA512

5e851ee463d10643b8858887b65ffb7801e10cde2d6e7522150dde1bf323542073e586c2cc34e945c5ef5b77dbf473cb3a0a8182b24726635eb6187ecd57c736
SSDEEP

3072:VPGjovIuI35vtbYZJgQ5OfDVrrCZkqIpXlmHeVSwHvCAvbIU9dDKx:VP+o2JvtmJZ5Of60X1vCm8U9d

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4412	Unicorn-45614.exe
4516	Unicorn-39558.exe
3164	Unicorn-27860.exe
3468	Unicorn-24229.exe
4824	Unicorn-45208.exe
1396	Unicorn-51338.exe
3452	Unicorn-39640.exe
2692	Unicorn-41006.exe
4012	Unicorn-47840.exe
4260	Unicorn-55296.exe
4280	Unicorn-61426.exe
1868	Unicorn-28239.exe
3240	Unicorn-61426.exe
4532	Unicorn-41560.exe
2520	Unicorn-11156.exe
3200	Unicorn-30913.exe
3584	Unicorn-44789.exe
2336	Unicorn-64654.exe
4628	Unicorn-10035.exe
4972	Unicorn-31790.exe
4368	Unicorn-37912.exe
1888	Unicorn-32344.exe
1656	Unicorn-52210.exe
2800	Unicorn-55532.exe
1828	Unicorn-963.exe
3712	Unicorn-52765.exe
876	Unicorn-461.exe
1788	Unicorn-58799.exe
2624	Unicorn-14228.exe
3304	Unicorn-21327.exe
3296	Unicorn-21327.exe
2184	Unicorn-1037.exe
2224	Unicorn-43414.exe
5016	Unicorn-57919.exe
4364	Unicorn-15188.exe
4840	Unicorn-47114.exe
3504	Unicorn-33793.exe
2412	Unicorn-46045.exe
4164	Unicorn-55837.exe
1132	Unicorn-16287.exe
464	Unicorn-9900.exe
3728	Unicorn-34670.exe
4688	Unicorn-22418.exe
1560	Unicorn-41504.exe
4940	Unicorn-53060.exe
3536	Unicorn-58660.exe
3472	Unicorn-35639.exe
4904	Unicorn-54021.exe
2276	Unicorn-9973.exe
2828	Unicorn-14057.exe
2028	Unicorn-46408.exe
3024	Unicorn-6858.exe
3576	Unicorn-46621.exe
4552	Unicorn-47176.exe
2212	Unicorn-9407.exe
4396	Unicorn-1504.exe
5080	Unicorn-35137.exe
1096	Unicorn-41259.exe
4888	Unicorn-39552.exe
1080	Unicorn-36014.exe
3856	Unicorn-45682.exe
4372	Unicorn-50735.exe
1456	Unicorn-3580.exe
2024	Unicorn-28639.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
9772	9972	WerFault.exe	456
13844	6416	WerFault.exe	279
14508	1052	WerFault.exe	277
18200	16660	WerFault.exe	858
4540	6408	WerFault.exe	280

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33504.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6020	dwm.exe
Token: SeChangeNotifyPrivilege	6020	dwm.exe
Token: 33	6020	dwm.exe
Token: SeIncBasePriorityPrivilege	6020	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4116	76aa578a7b14dc9a15b535d43ccc11e0N.exe
4412	Unicorn-45614.exe
3164	Unicorn-27860.exe
4516	Unicorn-39558.exe
3468	Unicorn-24229.exe
1396	Unicorn-51338.exe
3452	Unicorn-39640.exe
4824	Unicorn-45208.exe
2692	Unicorn-41006.exe
3240	Unicorn-61426.exe
4260	Unicorn-55296.exe
4532	Unicorn-41560.exe
1868	Unicorn-28239.exe
4280	Unicorn-61426.exe
4012	Unicorn-47840.exe
2520	Unicorn-11156.exe
3200	Unicorn-30913.exe
3584	Unicorn-44789.exe
2336	Unicorn-64654.exe
4628	Unicorn-10035.exe
1828	Unicorn-963.exe
1888	Unicorn-32344.exe
4972	Unicorn-31790.exe
4368	Unicorn-37912.exe
3712	Unicorn-52765.exe
2800	Unicorn-55532.exe
1656	Unicorn-52210.exe
876	Unicorn-461.exe
1788	Unicorn-58799.exe
2624	Unicorn-14228.exe
3304	Unicorn-21327.exe
3296	Unicorn-21327.exe
2184	Unicorn-1037.exe
2224	Unicorn-43414.exe
4364	Unicorn-15188.exe
5016	Unicorn-57919.exe
3504	Unicorn-33793.exe
4840	Unicorn-47114.exe
2412	Unicorn-46045.exe
464	Unicorn-9900.exe
4164	Unicorn-55837.exe
1132	Unicorn-16287.exe
3728	Unicorn-34670.exe
4688	Unicorn-22418.exe
1560	Unicorn-41504.exe
3536	Unicorn-58660.exe
2276	Unicorn-9973.exe
4904	Unicorn-54021.exe
2828	Unicorn-14057.exe
4940	Unicorn-53060.exe
2028	Unicorn-46408.exe
3024	Unicorn-6858.exe
3472	Unicorn-35639.exe
4396	Unicorn-1504.exe
4552	Unicorn-47176.exe
2212	Unicorn-9407.exe
3576	Unicorn-46621.exe
5080	Unicorn-35137.exe
1096	Unicorn-41259.exe
4888	Unicorn-39552.exe
3856	Unicorn-45682.exe
1080	Unicorn-36014.exe
4372	Unicorn-50735.exe
1456	Unicorn-3580.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4412	4116	76aa578a7b14dc9a15b535d43ccc11e0N.exe	91
PID 4116 wrote to memory of 4412	4116	76aa578a7b14dc9a15b535d43ccc11e0N.exe	91
PID 4116 wrote to memory of 4412	4116	76aa578a7b14dc9a15b535d43ccc11e0N.exe	91
PID 4412 wrote to memory of 4516	4412	Unicorn-45614.exe	93
PID 4412 wrote to memory of 4516	4412	Unicorn-45614.exe	93
PID 4412 wrote to memory of 4516	4412	Unicorn-45614.exe	93
PID 4116 wrote to memory of 3164	4116	76aa578a7b14dc9a15b535d43ccc11e0N.exe	94
PID 4116 wrote to memory of 3164	4116	76aa578a7b14dc9a15b535d43ccc11e0N.exe	94
PID 4116 wrote to memory of 3164	4116	76aa578a7b14dc9a15b535d43ccc11e0N.exe	94
PID 3164 wrote to memory of 3468	3164	Unicorn-27860.exe	97
PID 3164 wrote to memory of 3468	3164	Unicorn-27860.exe	97
PID 3164 wrote to memory of 3468	3164	Unicorn-27860.exe	97
PID 4516 wrote to memory of 1396	4516	Unicorn-39558.exe	98
PID 4516 wrote to memory of 1396	4516	Unicorn-39558.exe	98
PID 4516 wrote to memory of 1396	4516	Unicorn-39558.exe	98
PID 4116 wrote to memory of 4824	4116	76aa578a7b14dc9a15b535d43ccc11e0N.exe	99
PID 4116 wrote to memory of 4824	4116	76aa578a7b14dc9a15b535d43ccc11e0N.exe	99
PID 4116 wrote to memory of 4824	4116	76aa578a7b14dc9a15b535d43ccc11e0N.exe	99
PID 4412 wrote to memory of 3452	4412	Unicorn-45614.exe	100
PID 4412 wrote to memory of 3452	4412	Unicorn-45614.exe	100
PID 4412 wrote to memory of 3452	4412	Unicorn-45614.exe	100
PID 3452 wrote to memory of 2692	3452	Unicorn-39640.exe	101
PID 3452 wrote to memory of 2692	3452	Unicorn-39640.exe	101
PID 3452 wrote to memory of 2692	3452	Unicorn-39640.exe	101
PID 4824 wrote to memory of 4280	4824	Unicorn-45208.exe	102
PID 4824 wrote to memory of 4280	4824	Unicorn-45208.exe	102
PID 4824 wrote to memory of 4280	4824	Unicorn-45208.exe	102
PID 4412 wrote to memory of 4260	4412	Unicorn-45614.exe	103
PID 4412 wrote to memory of 4260	4412	Unicorn-45614.exe	103
PID 4412 wrote to memory of 4260	4412	Unicorn-45614.exe	103
PID 4116 wrote to memory of 4012	4116	76aa578a7b14dc9a15b535d43ccc11e0N.exe	106
PID 4116 wrote to memory of 4012	4116	76aa578a7b14dc9a15b535d43ccc11e0N.exe	106
PID 4116 wrote to memory of 4012	4116	76aa578a7b14dc9a15b535d43ccc11e0N.exe	106
PID 1396 wrote to memory of 3240	1396	Unicorn-51338.exe	105
PID 1396 wrote to memory of 3240	1396	Unicorn-51338.exe	105
PID 1396 wrote to memory of 3240	1396	Unicorn-51338.exe	105
PID 4516 wrote to memory of 1868	4516	Unicorn-39558.exe	107
PID 4516 wrote to memory of 1868	4516	Unicorn-39558.exe	107
PID 4516 wrote to memory of 1868	4516	Unicorn-39558.exe	107
PID 3164 wrote to memory of 4532	3164	Unicorn-27860.exe	104
PID 3164 wrote to memory of 4532	3164	Unicorn-27860.exe	104
PID 3164 wrote to memory of 4532	3164	Unicorn-27860.exe	104
PID 3468 wrote to memory of 2520	3468	Unicorn-24229.exe	108
PID 3468 wrote to memory of 2520	3468	Unicorn-24229.exe	108
PID 3468 wrote to memory of 2520	3468	Unicorn-24229.exe	108
PID 2692 wrote to memory of 3200	2692	Unicorn-41006.exe	109
PID 2692 wrote to memory of 3200	2692	Unicorn-41006.exe	109
PID 2692 wrote to memory of 3200	2692	Unicorn-41006.exe	109
PID 3452 wrote to memory of 3584	3452	Unicorn-39640.exe	110
PID 3452 wrote to memory of 3584	3452	Unicorn-39640.exe	110
PID 3452 wrote to memory of 3584	3452	Unicorn-39640.exe	110
PID 4260 wrote to memory of 2336	4260	Unicorn-55296.exe	111
PID 4260 wrote to memory of 2336	4260	Unicorn-55296.exe	111
PID 4260 wrote to memory of 2336	4260	Unicorn-55296.exe	111
PID 4412 wrote to memory of 4628	4412	Unicorn-45614.exe	112
PID 4412 wrote to memory of 4628	4412	Unicorn-45614.exe	112
PID 4412 wrote to memory of 4628	4412	Unicorn-45614.exe	112
PID 4532 wrote to memory of 4972	4532	Unicorn-41560.exe	113
PID 4532 wrote to memory of 4972	4532	Unicorn-41560.exe	113
PID 4532 wrote to memory of 4972	4532	Unicorn-41560.exe	113
PID 3164 wrote to memory of 4368	3164	Unicorn-27860.exe	114
PID 3164 wrote to memory of 4368	3164	Unicorn-27860.exe	114
PID 3164 wrote to memory of 4368	3164	Unicorn-27860.exe	114
PID 1396 wrote to memory of 1888	1396	Unicorn-51338.exe	115

C:\Users\Admin\AppData\Local\Temp\76aa578a7b14dc9a15b535d43ccc11e0N.exe
"C:\Users\Admin\AppData\Local\Temp\76aa578a7b14dc9a15b535d43ccc11e0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45614.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45614.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14228.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        8⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        9⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        10⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        10⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        10⤵
        
        PID:17368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        10⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49356.exe
        9⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        10⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
        9⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26604.exe
        9⤵
        
        PID:17416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43631.exe
        8⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        8⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
        8⤵
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19568.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        8⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55078.exe
        9⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        8⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        8⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        8⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
        7⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
        7⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        7⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41259.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5884.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        8⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
        9⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
        9⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        9⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        8⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        8⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15515.exe
        8⤵
        
        PID:17184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33844.exe
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
        8⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        8⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exe
        7⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        7⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53902.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1025.exe
        8⤵
        
        PID:15968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        8⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4164.exe
        7⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45383.exe
        7⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3568.exe
        7⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4109.exe
        6⤵
        
        PID:13644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34395.exe
        6⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22418.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48048.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        8⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        8⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        8⤵
        
        PID:16596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        8⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14710.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35197.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17066.exe
        7⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        7⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
        8⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        7⤵
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16728.exe
        7⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exe
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
        6⤵
        
        PID:11112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52581.exe
        6⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14893.exe
        6⤵
        
        PID:8380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20462.exe
        7⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
        8⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45633.exe
        8⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        8⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        8⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        7⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
        7⤵
        
        PID:13848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18558.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        6⤵
        
        PID:15548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        6⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        6⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
        6⤵
        
        PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22771.exe
        5⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        6⤵
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        6⤵
        
        PID:17620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65528.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13975.exe
        5⤵
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21327.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        8⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        9⤵
        
        PID:16928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
        9⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40707.exe
        8⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
        8⤵
        
        PID:16264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
        7⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4347.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38668.exe
        7⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6055.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        7⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        7⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        7⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48260.exe
        6⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        7⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40433.exe
        6⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        6⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18056.exe
        6⤵
        
        PID:12396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39552.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22382.exe
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe
        8⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17143.exe
        8⤵
        
        PID:16180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15700.exe
        7⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        7⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        7⤵
        
        PID:14344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53579.exe
        6⤵
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        6⤵
        
        PID:17136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
        6⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33824.exe
        5⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58090.exe
        6⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        7⤵
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7127.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48948.exe
        6⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
        6⤵
        
        PID:17412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17831.exe
        5⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21150.exe
        6⤵
        
        PID:12528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        6⤵
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
        5⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        5⤵
        
        PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33793.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
        6⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15505.exe
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33970.exe
        8⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53697.exe
        8⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        8⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
        8⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        7⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
        7⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        7⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29848.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
        8⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        7⤵
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        6⤵
        
        PID:13028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        6⤵
        
        PID:16884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        6⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
        5⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        6⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        7⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3428.exe
        7⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        6⤵
        
        PID:10864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        6⤵
        
        PID:18044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        5⤵
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
        5⤵
        
        PID:13768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33883.exe
        5⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9657.exe
        5⤵
        
        PID:456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        5⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        8⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
        8⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        7⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exe
        7⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        7⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8078.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18196.exe
        6⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        6⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        6⤵
        
        PID:18092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        6⤵
        
        PID:12884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5627.exe
        5⤵
        
        PID:14388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
        5⤵
        
        PID:7380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24653.exe
        6⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        5⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        5⤵
        
        PID:14872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        5⤵
        
        PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37839.exe
      4⤵
      PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17056.exe
      4⤵
      PID:9500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
      4⤵
      PID:13692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41006.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30913.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3580.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
        8⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53902.exe
        9⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        10⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61248.exe
        10⤵
        
        PID:18032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        9⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        9⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        9⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
        8⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        8⤵
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        8⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        8⤵
        
        PID:18136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9060.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        8⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        8⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6267.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1647.exe
        7⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45764.exe
        7⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        7⤵
        
        PID:17108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25624.exe
        6⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7337.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        8⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        8⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        8⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        7⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        7⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        7⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
        6⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61319.exe
        7⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54429.exe
        7⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exe
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65108.exe
        6⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        6⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2184.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21038.exe
        8⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe
        9⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        9⤵
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        9⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
        8⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
        8⤵
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        8⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
        7⤵
        
        PID:15328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
        7⤵
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42100.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        7⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
        8⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
        8⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        7⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        7⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55701.exe
        7⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32753.exe
        6⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        6⤵
        
        PID:16788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        6⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
        5⤵
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45841.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        8⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        7⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        6⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        7⤵
        
        PID:16272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1895.exe
        6⤵
        
        PID:11440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33900.exe
        6⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
        6⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31873.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        6⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        7⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        7⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        6⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        6⤵
        
        PID:16400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52123.exe
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2207.exe
        5⤵
        
        PID:13132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        5⤵
        
        PID:17444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        5⤵
        
        PID:8724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44789.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46045.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-72.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-72.exe
        6⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        8⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exe
        8⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46504.exe
        8⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39365.exe
        8⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        7⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
        7⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        7⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43740.exe
        6⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        7⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        7⤵
        
        PID:17676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exe
        7⤵
        
        PID:15744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18558.exe
        6⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
        6⤵
        
        PID:15028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        6⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        5⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62262.exe
        6⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        7⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
        7⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15347.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe
        6⤵
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
        6⤵
        
        PID:16684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58436.exe
        5⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
        5⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
        5⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        5⤵
        
        PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16287.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4156.exe
        5⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22382.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5975.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exe
        7⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        7⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57576.exe
        6⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9520.exe
        7⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exe
        7⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1127.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        6⤵
        
        PID:15184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42952.exe
        6⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54473.exe
        6⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33589.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
        7⤵
        
        PID:17820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        6⤵
        
        PID:12844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        6⤵
        
        PID:17380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        6⤵
        
        PID:18064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        5⤵
        
        PID:9168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28669.exe
        5⤵
        
        PID:12936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50995.exe
        5⤵
        
        PID:17352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-492.exe
      4⤵
      PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-721.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10686.exe
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        5⤵
        
        PID:12852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
        5⤵
        
        PID:17396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        5⤵
        
        PID:12364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57032.exe
      4⤵
      PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
        5⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3428.exe
        5⤵
        
        PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38143.exe
      4⤵
      PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57949.exe
      4⤵
      PID:13780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29418.exe
      4⤵
      PID:17808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
      4⤵
      PID:17920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
        6⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27758.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        8⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        8⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        8⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
        8⤵
        
        PID:17852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25463.exe
        8⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3668.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
        7⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29848.exe
        6⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48526.exe
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        7⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        7⤵
        
        PID:16720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        7⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
        6⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32753.exe
        6⤵
        
        PID:12788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        6⤵
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe
        6⤵
        
        PID:18072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45552.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        6⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        7⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61248.exe
        7⤵
        
        PID:18212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45752.exe
        7⤵
        
        PID:18236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8624.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
        6⤵
        
        PID:14400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
        6⤵
        
        PID:15860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9976.exe
        5⤵
        
        PID:9972
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9972 -s 464
        6⤵
        Program crash
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13911.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56873.exe
        5⤵
        
        PID:12336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55837.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe
        6⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28249.exe
        7⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61248.exe
        7⤵
        
        PID:18044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        7⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28807.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        6⤵
        
        PID:13888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe
        6⤵
        
        PID:17036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        5⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        6⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        6⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        6⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        6⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30994.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
        5⤵
        
        PID:13896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
        5⤵
        
        PID:18072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        5⤵
        
        PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40896.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        5⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29355.exe
        5⤵
        
        PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48475.exe
      4⤵
      PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10079.exe
      4⤵
      PID:11484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47062.exe
      4⤵
      PID:15192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50539.exe
      4⤵
      PID:17548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10035.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43414.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45490.exe
        5⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2184.exe
        6⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5975.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exe
        7⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        7⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20055.exe
        6⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23568.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        6⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30500.exe
        6⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
        6⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3521.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-304.exe
        7⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5944.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        6⤵
        
        PID:17012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        6⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5774.exe
        5⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45841.exe
        6⤵
        
        PID:16372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        6⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
        5⤵
        
        PID:10500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
        5⤵
        
        PID:15228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
      4⤵
      Executes dropped EXE
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        5⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19969.exe
        6⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28249.exe
        7⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12555.exe
        7⤵
        
        PID:16920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
        6⤵
        
        PID:13860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15311.exe
        6⤵
        
        PID:18052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        6⤵
        
        PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2407.exe
        5⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        5⤵
        
        PID:11140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
        5⤵
        
        PID:15220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        5⤵
        
        PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        5⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18462.exe
        6⤵
        
        PID:3540
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 652
        6⤵
        Program crash
        
        PID:14508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23515.exe
        5⤵
        
        PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        5⤵
        
        PID:13480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16536.exe
        5⤵
        
        PID:11508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
        5⤵
        
        PID:13324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        5⤵
        
        PID:17720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
      4⤵
      PID:10952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6587.exe
      4⤵
      PID:15156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
      4⤵
      PID:5780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36061.exe
      4⤵
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        6⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        7⤵
        
        PID:17148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47687.exe
        6⤵
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
        5⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30133.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53781.exe
        6⤵
        
        PID:17164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        5⤵
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        5⤵
        
        PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12272.exe
      4⤵
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exe
        5⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13381.exe
        6⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45633.exe
        5⤵
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        5⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        5⤵
        
        PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
      4⤵
      PID:9260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
      4⤵
      PID:13240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
      4⤵
      PID:16644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38668.exe
      4⤵
      PID:1184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11171.exe
    3⤵
    PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38085.exe
      4⤵
      PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58038.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
        5⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        5⤵
        
        PID:17376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
      4⤵
      PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
      4⤵
      PID:14732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
      4⤵
      PID:6916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45310.exe
    3⤵
    PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
      4⤵
      PID:16156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
      4⤵
      PID:6280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
    3⤵
    PID:8504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
    3⤵
    PID:13792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28283.exe
    3⤵
    PID:17788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
    3⤵
    PID:8280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24229.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-461.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25153.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6564.exe
        8⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe
        9⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30163.exe
        9⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        9⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        8⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24879.exe
        8⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8368.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12028.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        8⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        8⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        7⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
        7⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        7⤵
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        8⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exe
        9⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
        8⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        8⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17560.exe
        7⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10708.exe
        7⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        7⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36282.exe
        7⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe
        7⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
        7⤵
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34673.exe
        6⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45707.exe
        6⤵
        
        PID:13412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        6⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26222.exe
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        8⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
        8⤵
        
        PID:17924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        8⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
        7⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26604.exe
        7⤵
        
        PID:17436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        7⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        6⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37059.exe
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50288.exe
        6⤵
        
        PID:13468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        6⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7647.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24653.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        7⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        6⤵
        
        PID:15004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
        5⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
        6⤵
        
        PID:15256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1504.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        7⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        8⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        8⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        8⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        8⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5692.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        7⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42952.exe
        7⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62624.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
        6⤵
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35122.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        6⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4211.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        6⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2960.exe
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        5⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
        5⤵
        
        PID:10780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9407.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9475.exe
        7⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36334.exe
        7⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42064.exe
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57824.exe
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        5⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
        6⤵
        
        PID:11428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        6⤵
        
        PID:17004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45752.exe
        6⤵
        
        PID:14012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61755.exe
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
        5⤵
        
        PID:13616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50419.exe
        5⤵
        
        PID:17836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12820.exe
        5⤵
        
        PID:516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37711.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8977.exe
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36082.exe
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        6⤵
        
        PID:12944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        6⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30004.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
        5⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        5⤵
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38031.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63331.exe
      4⤵
      PID:11868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
      4⤵
      PID:388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20816.exe
      4⤵
      PID:16376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31790.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14057.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        7⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        8⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6416 -s 724
        8⤵
        Program crash
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        7⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        8⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36676.exe
        8⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
        7⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
        7⤵
        
        PID:17752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17403.exe
        6⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43522.exe
        7⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25192.exe
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50040.exe
        6⤵
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        6⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5287.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15728.exe
        6⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56292.exe
        6⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        6⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57175.exe
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
        6⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24424.exe
        6⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25192.exe
        5⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50040.exe
        5⤵
        
        PID:14396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        5⤵
        
        PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58660.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-612.exe
        6⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57621.exe
        7⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        6⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
        7⤵
        
        PID:16700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
        7⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44200.exe
        6⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
        6⤵
        
        PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
        5⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28669.exe
        5⤵
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        5⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18248.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19022.exe
      4⤵
      PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
        6⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        6⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51425.exe
        6⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40720.exe
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26887.exe
        5⤵
        
        PID:13172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
        5⤵
        
        PID:16660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16660 -s 248
        6⤵
        Program crash
        
        PID:18200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-160.exe
      4⤵
      PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9475.exe
        5⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
        5⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40940.exe
      4⤵
      PID:9220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40032.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
      4⤵
      PID:17464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
      4⤵
      PID:6272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37912.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        5⤵
        
        PID:412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        7⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        7⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27074.exe
        7⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53552.exe
        6⤵
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
        6⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18462.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28108.exe
        6⤵
        
        PID:16888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        6⤵
        
        PID:12340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30781.exe
        5⤵
        
        PID:9832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exe
        5⤵
        
        PID:16452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41650.exe
        5⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27037.exe
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        6⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe
        5⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
        6⤵
        
        PID:16448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23656.exe
        6⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57175.exe
      4⤵
      PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        5⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5648.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11940.exe
      4⤵
      PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe
        5⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        6⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        6⤵
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        6⤵
        
        PID:15316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        6⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        5⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
        6⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60605.exe
        6⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18934.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47780.exe
        5⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18977.exe
        5⤵
        
        PID:7684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
      4⤵
      PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40550.exe
        5⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18462.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        6⤵
        
        PID:17172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        6⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        5⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        5⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        5⤵
        
        PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20387.exe
      4⤵
      PID:9504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
      4⤵
      PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27568.exe
      4⤵
      PID:17728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exe
    3⤵
    PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        5⤵
        
        PID:10976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        5⤵
        
        PID:16572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        5⤵
        
        PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
      4⤵
      PID:9484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51248.exe
      4⤵
      PID:14528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
      4⤵
      PID:1012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28244.exe
    3⤵
    PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18462.exe
      4⤵
      PID:11268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58093.exe
      4⤵
      PID:17320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60362.exe
    3⤵
    PID:10176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24166.exe
    3⤵
    PID:13696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
    3⤵
    PID:17760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24900.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21327.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45682.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13860.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
        8⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        8⤵
        
        PID:17896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        8⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        7⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11239.exe
        7⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54265.exe
        6⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2724.exe
        7⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        7⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48543.exe
        6⤵
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55441.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe
        6⤵
        
        PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18307.exe
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        6⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14621.exe
        7⤵
        
        PID:16340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 608
        7⤵
        Program crash
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        6⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        6⤵
        
        PID:14888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
        6⤵
        
        PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17403.exe
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54885.exe
        5⤵
        
        PID:15652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50735.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34089.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41650.exe
        6⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        7⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9187.exe
        7⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        6⤵
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14827.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
        6⤵
        
        PID:17860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        6⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        5⤵
        
        PID:11248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe
        5⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
        5⤵
        
        PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
      4⤵
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
        5⤵
        
        PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        5⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        5⤵
        
        PID:7680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56560.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        5⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
        5⤵
        
        PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
      4⤵
      PID:11320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4877.exe
      4⤵
      PID:16056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
      4⤵
      PID:7088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52765.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54021.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        6⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        6⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
        5⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        6⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        6⤵
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52877.exe
        5⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        5⤵
        
        PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39220.exe
      4⤵
      PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16129.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
        6⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15436.exe
        6⤵
        
        PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        5⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5991.exe
        5⤵
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        5⤵
        
        PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47580.exe
      4⤵
      PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2960.exe
      4⤵
      PID:10228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
      4⤵
      PID:12300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6858.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38858.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23638.exe
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        6⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        6⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
        6⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        5⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
        5⤵
        
        PID:14740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        5⤵
        
        PID:7196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
      4⤵
      PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
        5⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        6⤵
        
        PID:15732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23656.exe
        6⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        5⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        5⤵
        
        PID:16116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
      4⤵
      PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
      4⤵
      PID:13972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe
      4⤵
      PID:17432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58821.exe
    3⤵
    PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38085.exe
      4⤵
      PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36274.exe
        5⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        5⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        5⤵
        
        PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55893.exe
        5⤵
        
        PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
      4⤵
      PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
      4⤵
      PID:14756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
      4⤵
      PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31458.exe
    3⤵
    PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18462.exe
      4⤵
      PID:11348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
      4⤵
      PID:16652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
    3⤵
    PID:10196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45697.exe
    3⤵
    PID:13728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exe
    3⤵
    PID:17828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45661.exe
      4⤵
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        5⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        6⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe
        7⤵
        
        PID:17916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39224.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        6⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16304.exe
        5⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
        5⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41099.exe
        5⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
      4⤵
      PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48225.exe
        5⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        5⤵
        
        PID:13108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
        5⤵
        
        PID:17704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4296.exe
      4⤵
      PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18742.exe
      4⤵
      PID:13252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58772.exe
      4⤵
      PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14893.exe
      4⤵
      PID:1084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
      4⤵
      PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45633.exe
        6⤵
        
        PID:13096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        6⤵
        
        PID:17456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        6⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1943.exe
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11558.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        5⤵
        
        PID:12360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
      4⤵
      PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57709.exe
        5⤵
        
        PID:15760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        5⤵
        
        PID:18256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41008.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
      4⤵
      PID:15260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
      4⤵
      PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
    3⤵
    PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24022.exe
        5⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        5⤵
        
        PID:12892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        5⤵
        
        PID:18052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6652.exe
      4⤵
      PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51248.exe
      4⤵
      PID:14548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61613.exe
    3⤵
    PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
      4⤵
      PID:13520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
      4⤵
      PID:17932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
      4⤵
      PID:6336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
    3⤵
    PID:9344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17256.exe
    3⤵
    PID:13120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65246.exe
    3⤵
    PID:17184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
      4⤵
      PID:716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        5⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe
        6⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        7⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        6⤵
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        6⤵
        
        PID:18020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        5⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        5⤵
        
        PID:12952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        5⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28249.exe
        5⤵
        
        PID:13224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53781.exe
        5⤵
        
        PID:17108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
      4⤵
      PID:13708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe
      4⤵
      PID:16568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57612.exe
    3⤵
    PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
      4⤵
      PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35234.exe
        6⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
        6⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        5⤵
        
        PID:12868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        5⤵
        
        PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55701.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8624.exe
      4⤵
      PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40273.exe
        5⤵
        
        PID:18016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
      4⤵
      PID:12996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53720.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
      4⤵
      PID:13488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
      4⤵
      PID:4692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
    3⤵
    PID:11396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-531.exe
    3⤵
    PID:16240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14893.exe
    3⤵
    PID:8968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53060.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53060.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
    3⤵
    PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
      4⤵
      PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
        5⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25421.exe
        6⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        5⤵
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6379.exe
        5⤵
        
        PID:14700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
      4⤵
      PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14548.exe
      4⤵
      PID:16320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47855.exe
    3⤵
    PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
      4⤵
      PID:15284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
      4⤵
      PID:6344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
    3⤵
    PID:12488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
    3⤵
    PID:16612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
    3⤵
    PID:8872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
  2⤵
  PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53902.exe
    3⤵
    PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48225.exe
      4⤵
      PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
      4⤵
      PID:12836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
      4⤵
      PID:16616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
      4⤵
      PID:2448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34999.exe
    3⤵
    PID:9760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35440.exe
    3⤵
    PID:13976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15311.exe
    3⤵
    PID:18064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
    3⤵
    PID:2988
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
  2⤵
  PID:4500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
  2⤵
  PID:10220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
  2⤵
  PID:14804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
  2⤵
  PID:7608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9972 -ip 9972
1⤵
PID:5716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6416 -ip 6416
1⤵
PID:13680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1052 -ip 1052
1⤵
PID:15180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6408 -ip 6408
1⤵
PID:396

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10035.exe

Filesize
468KB

MD5
1aecddb2ffce945f0a1cbc6af3a35bcb

SHA1
7b96e1f83790729188f41f2aeb919336791996e6

SHA256
7c224fa69c2ecbae33646f24d06277905e06337d4b49507ce91731bedff4e88a

SHA512
ab8ef9acd70ac311201d6ff8ac3a4e89ee6516bd894abe1b0c19eb31196249f8a40ac4cd9983e0421ae2a64df436d86eec3d21b437386ca1920774dfd5b38929

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe

Filesize
468KB

MD5
5f329c702590b9387174b88649f50d5c

SHA1
fd1f4827a6c7d0e151f0911cdb3fd1d2d2564770

SHA256
a2fa3f9bd4434d82c8e35ab63ebab6007fad7ad8dc5006da1385d8befd0cc62b

SHA512
fd824f355cabd994a1b067afec97769407ecddadc0061d073cfe6ff4ba946685bb598c344980a122d4b92fff751f278a11f0c2f8abef36ccc61a8874847a5a8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe

Filesize
468KB

MD5
3f7d70f67a226bbf75d6ffb5b7ee50fa

SHA1
69d51d89636e32520d1401de425710c70de75274

SHA256
fcaa5537ee171d3fcde47db7f20dad02debd7c4da77bf046012f9f07c1f6d851

SHA512
eb3525b5a5274fbf28b55bc8cadf0e8d7c7f47617a1ab68a19cc9b93442ea460d856d477c076483f336d7cbf1c6c2189768c46bc8021ce8c9bb790a88edd341a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14228.exe

Filesize
468KB

MD5
a60b850422b6f144c7c71887984eb1bd

SHA1
750cb657718b039ac2b6dcb44e03b2ba6272d068

SHA256
4438c30d7211e1e7d26b6b82dfe2594ccd254b1edc868cf64cdf8344f62e1f56

SHA512
289f806d33e0a19d4b2f550ea7175890ee9cbccc2b885054454e420c5ee10b52d4233ea97e89de69b014c0faaec09e3ec0593089c1ee58b8336448d4dbb549ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21327.exe

Filesize
468KB

MD5
56e744b37ce052ef7b26af41bcbece5c

SHA1
c09d9c474cae533704d145e6a0bdb001aba973f1

SHA256
5ec3af813edc1599a1646c0e0e73a5a2b4b8c83fab209f7aff243f54c57129d7

SHA512
a772a66bdcd9ce3a47190dc27387c59f55ef19dd65ec8f8271ecd71cb064cc18b178309323b45f95ea9086a0025263fdaef548e6ef95e93a579306cec651f016

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24229.exe

Filesize
468KB

MD5
0e3d34db1ec47083abb8891f4d30ca42

SHA1
29d60649b4821f4abbe0ca1a11c31f4da39a8ed5

SHA256
60fea0e0f8342cf49c1c5abb68ec1235aa6ee8a1264225b0ba809bed8ddb72ca

SHA512
d99b9932afc4300a01ac3e1f96e821652588ed90bdca4b8ce2ceeadfc750c3551304a82f2611be2a662379311c0fee1929306c2352a3846a65fa4387da5d1bf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe

Filesize
468KB

MD5
08a796f2b54963aa3a50a5a6443fb289

SHA1
59ec7d4f968b8e22b96cee8189ca5c8634fc8a75

SHA256
d4d76859706d89492fcc11b8c9a5f802bc083878d7d9624480382911e8c03a0d

SHA512
42c381e001dc2d35cc8cbd8cef4d5c0c6a646bc3ec896071f0ff8007d8a82bbc848082e38e83796e865bb28f7628b296d09e370e64d7e863b98f8fd388c0daab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe

Filesize
468KB

MD5
252f7ad006f162b0186f0857266d460f

SHA1
e61cf1c307490f4334eb9a51b09776db946d7e00

SHA256
1d9d03c556ca3dab4d99c27c385cc0e9c8d9f03b9ab2ab3ed9f151b11b2f131a

SHA512
d8cf715e654e37971d56a36cef8912fca8c118b168b0eea9ec7b686dff441936628f6e696d77e2b8792158a5522effa9b01cd1c9f96ed69f9cb01b4630810953

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30913.exe

Filesize
468KB

MD5
20c5e46242ace86b9483c48fa4694d8e

SHA1
596a0cea0dca33dd005a071805a684121aa57651

SHA256
620ee0282963bf623b2d5023ae2b0d67c889230272394b024030814adac4ba84

SHA512
59f01613b033af6043dc275e8d846c929c8092eeca7a6cd0c560a5e14d9ffa6b6264bf5959b104f11ec92f1c774b66b7918eb02494ccc6711afbd632410efc29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31790.exe

Filesize
468KB

MD5
0cb64d0cf4978936e68a5b7ce82c0d5e

SHA1
cd168d3a45d32fdb4c0267deeb16145ba2c064ea

SHA256
3d29ff7635de0e7699bf9053a5b92390e84092bba60293b8aba80e6e8235cf5c

SHA512
45c4642b88cb174e6c6d0388672c27043e999566732f999ee27ddc9de8139eae6eacad78253898085ec517b9c84768696e931547c1d794ee74ec1a254211297e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe

Filesize
468KB

MD5
2c617b5fcbd86ff9f86335a1836ac2b6

SHA1
39342701eea81deece06cfb77d11c973dfc83f5b

SHA256
38ffa2287a8613a90ff91d656aca33b4c18157e0b4437a7093ca667bbf57bf09

SHA512
653bd93dfba434e7989a292ec98279adbd74e58ddb08a9273f1d4ed8e3abd2726ad904fc9e683a09026e12e32d8a1ce6f7e4dc4f3f9ef7c405311b92961f8931

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37912.exe

Filesize
468KB

MD5
0c6e4d8f76614e7a6b26ac1f6755cb7d

SHA1
6ec2590c7b98b5e67c890b81096014a3685b80d6

SHA256
7b1f4871e2ca75b0709a56d8f9d3ed5ed3beafbf40663b2b14e8938ffa7adcc7

SHA512
dca965ea8af285b315a769d2e0fd8047ee0edbdc4b2e2a9967fe5bc91438bc3c7f55e7e9c8fd575e1092691ee192241c29b2b66ea2a03e15144c01857c90e2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe

Filesize
468KB

MD5
b1b6eebc03344288032c51c7d9f5dc3e

SHA1
5fcd9eb9c619efc580b7bcf1a8e733825b8b54f3

SHA256
4fd64825a2841ed9533e5e840fcb9f28b2543a7c79c585fdf37713d114c82579

SHA512
647fcce1dd243b2604d761d0d482582f8fc08c015f41c59a04d2d1a0ed77b735cbd19262a2bcff01446acd88bc8fb470358d027676c757e818f1922b7e82291e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe

Filesize
468KB

MD5
e8c70db752669af196c22741f91b30bf

SHA1
7a7ef74b4157d75b1c783dae028e805af2b8afc4

SHA256
e7a4f97df23d115c4a1f1f19891cd5d74e153f3af4fe0f62d3e072ce8d795d76

SHA512
bfaa40d7f029c20bcd2668463e0f02df4d66324a416df004041b24d9a825bdab754192a109dfb6922b4d173d090bf0bf7ea0bced2b42ef034a52fc8aa6576ddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41006.exe

Filesize
468KB

MD5
b691a91ea71feae7c98dcf859b21651d

SHA1
d8010e54b9597ec23c0a8f19c76044054a666860

SHA256
37e1f83e9404cffe313fe32eccad9b508401954a8619134647ea8861a23e2eff

SHA512
41264caed33ede90fac0f8ed7061cddc4d460f988c615104bb355086d4114a506126664fc9656adf5158e633ace79d44d5b8a08dd7c99e3f5fb5207f2822069a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe

Filesize
468KB

MD5
a23a4bff03a54fb08b5d11e65651c9a0

SHA1
770d508d70778f390197654fbd11c981744620f5

SHA256
39904756ee6072c258ea1cd8f802881fcaf55829fd76679911781d03789826d2

SHA512
21f404fc8e0356896c704632770992cf3cd540aeaec95490a97353d51154d8917f09d412771077ee865f9bdaaab98bbce3b124b9e0b6203bf10a47b8a4ccddc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44789.exe

Filesize
468KB

MD5
fd05405e922d9c621482bd1b4f27e6d4

SHA1
4f39ceffa238a57883b1693263c62e138216e41e

SHA256
74393d3249c2cd5ca135813d7f8e98ee6ac5a9ba9d6c2732cd67ab5cbfea65a3

SHA512
6e751c3f1b20b85c925ff1851a1650d384e00d14ee6ae8eb05950f6d4942c5216519a1984cc6b10e8b6add8ac74a37033bfa89a366a6a3950f131ff7c83145fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe

Filesize
468KB

MD5
cff42e0544ba0829223fee6e42c4a7d4

SHA1
a46b2222dde2a4cbb008b3a96e68050e31eb085f

SHA256
0f2267988d8eba15d696e6fdb7e56330e82ea3b6e1ebbae951919dc6ab8454a0

SHA512
ef9475f5bdae6ff143ffe57829f44a79596063b0a42d5aa487382997268c74b133012ed8324749f71283294452e623c6908fd55f7393844035d02b2a1ded45d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45614.exe

Filesize
468KB

MD5
4dddeee6fa3140fee7d4b03424a4a356

SHA1
ea3c40e4fef65a5ecd6b33cc360cf5817e958f7a

SHA256
e5f541d5550ca5bea367cd8e8e7d1e2219d48027cfb6b42569bb7e401d079489

SHA512
b0a7e558c3ef682ee623cfbbcb1f0ff1e03adbcda76b2efdd65acaf3111d711d73e8daa18cb0533e6cdb8724c6a82cf42d5797982c35a41314e285dc3ebeed77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-461.exe

Filesize
468KB

MD5
484e1559ca6f14635669fe253f0ac1c3

SHA1
81031af6e88830fdb2325fddf3c189652c3f3d5e

SHA256
cd9c19abb330455452da89f935a58e06a05ac65ed1635d42b0b4126aecfcb1bf

SHA512
adaa1538f2684a1c301aad136cd4a43a1077970f708dbec128527cbbb2fdcc3cc51ad20c0e85376d91fd31ae50fc1fea50e5d0ae6f90641cf9d885aa3ba5e2f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe

Filesize
468KB

MD5
8bf13ad241c22d8d763f81cecce8fc3c

SHA1
00ff3603e3e9a469523f67bf8747d2ac0b341a05

SHA256
140c668baf789fb42bd257d7a9c228cec4f0fbb6e1b2cbfef2957ea7d5bec195

SHA512
f1cb2439236c499f4c65747ff8ceb9884abc2826b4f2adee9d6d3f133b2ce3a2a27af15fc165bdbf7cd5c00a14bf2b03787834ff183694eb85f4170e3cc71cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe

Filesize
468KB

MD5
fc657f2e3f559cef47c6d637a6284cfe

SHA1
80d49e4ff2c390c39b03fbde85c31d9441f4839b

SHA256
f6f8100892cec04b65160dd201369ad4f76dd5da39613bd34683d40075be3b47

SHA512
4b7acd5df08e517d3b1a3914bc9500a646a7da55f14a3779cb89cecc0677fd83061714bd8af2f5b1c4f3b767b9a40ba1fd10f03a946c3940ee8b125526582590

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe

Filesize
468KB

MD5
9e05c455b7b0a89a0fed25c3534c4a30

SHA1
fd2cf712c180e50a05deefc92da2824069fb7729

SHA256
5c792364c0c5699ecbdde04a326c9594a6327602350c754bb97cf9f9b824917d

SHA512
70a96b20aa43a432a6f2e6d49692d1734092c18bdd2facdba610d6456f19de29aa4ae00aa83ed8c7ee34bb8059f47fe55bc105e6ceb6e1fc2669fccecf6eb86e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52765.exe

Filesize
468KB

MD5
fa32ed5f320b5f207caaee627684de44

SHA1
8ee694f27a846d39e934275270d9b79709181fec

SHA256
107856a684447c3e263dfa49d7fb592566f13724d2b7c09eac4440301a3a68d0

SHA512
be8546cd2c72c598396cca724a3d16a9d8d34ec9b36fec904f8365f3d0b3d9a9e0c1bf48e3c95ff495aa9ef6a0edcda27ca29cba865c5a0b04602c2da8b7aebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe

Filesize
468KB

MD5
7430d2e72ecbba8931046c0f46fa182a

SHA1
6da1dd3f562a9ecb791f5d9eb6986b126af2b492

SHA256
d63dbfe407d6a012486f8d05fd9239e5f7a8e97550500f2f1ba1fab9365fa920

SHA512
86a45c4c786e51090606ecc6cfa3373301c198e93f0121218e89446120311f7c67823d56fcc8cdb87fcfb2d439ee339c161a4cb5d41f60c7f359b1f09901806e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe

Filesize
468KB

MD5
98eb17913f099b5dc2ef95ed7032dea8

SHA1
3a31aa363ad41e8a1d0e1390311c6909386aaf04

SHA256
ed8e609e160043ba6e9be502b5fcd70adc5e1c11b18d12a14ed3ece78839d052

SHA512
181bfa1da8bb5d80192bc0c87a30171ee30901d847fc22560de014fb623e0964421170583c9edb302ab9bc58f20e97245a09b19c524dcce3ae53ecf4e738eb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe

Filesize
468KB

MD5
2090333b373dc237ed12c71e4fb1dc67

SHA1
3db978af043f912b10abae4ee38cb466e049d9b6

SHA256
032b1350306936ca28cf632d51b1988f22ba44d1edcd27869bd3fc99638c66bb

SHA512
3ad9f47740e6e4be5ebe0a5828d2c6d542ab7d18cd215ee44e0e9e83cbee7a1406e2681cde55340928953f92e45fc6b6ad9c983c40e29e5bfb3b60f2bafe0984

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe

Filesize
468KB

MD5
78b19c929025d9c41ba3c6e1d7b7b7dd

SHA1
d8d97dc348f9c86dbc2c06199282d5ce3edf1597

SHA256
e80389a53c4b23efc8283617dbbd6e6cfa866832a4c01bec84ebded32b0f397d

SHA512
ad579854a6d276744803c9751b82c56ca3b8cb64a2873c44a76590740ee326e195a5ddcc89640d0f384fe72e567e9b5cca3b19e232709a4a69c4b912a2236353

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe

Filesize
468KB

MD5
e49823a73f4300de11bb3f6850f9d6bb

SHA1
04b16b861795f1514e1b14aae1266752da5e29ea

SHA256
097d43eaf334cc2238817be5031fede3930471002735acf47004bc2f6a8b1c23

SHA512
c50874250f360fa1cb0460528b02c2969837f3eff6fd55ca3fc3880d5a9f6db1cabebdc344d3d14ef5ec51415f733c260115f9bf7f6c9061397e000f4ba3c088

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe

Filesize
468KB

MD5
1ee62283e8f21fea2a7849151b340c8e

SHA1
e3120c09573b35ff689be4a374b728c392e5b101

SHA256
c9ab0f26c4b10b0e609461526ddcd3f7c744078031361cc2c355270a07a13bae

SHA512
5a069d610a73cc4ee096a6706b18ee68ae7d778816077279717a15f32976392fa4fae6075483982ec08809199e011f39c7fbf0f3d2bb62b83c470a85ce82e097

Download Submit
memory/3200-2676-0x0000000076420000-0x0000000076445000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads